CURL-CVE-2017-1000100: TFTP File Name Truncation Vulnerability in curl
Summary
CVE-2017-1000100: When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still w... Affects curl across 80 version ranges.
< 1a7f66a3de2625d10f65415e6eb3e56067dc0555
< 1b6c683ca6ddb33d35f07c2fbb89d4622d338048
< 1d3969b2152be0600484ade0aa76b37df6e67576
< 1dc54324f4ea1e18df4364dc130af9b3f8c7a401
< 2a05025510dcae46ac01fd457942061052ebed1b
< 2bf90d071016e279796e789f0ac223d635671a41
< 2c000d91f3c423cee0af44e8afc79b9d25a9e714
< 3c561c657c2f0e553b19115a506592a8bbd744bc
< 3cda1a23ce3eac67ff2689e74318377595761475
< 3fed9acaef45ac8b99ceecc38afbed3494e2d3ef
< 4b1782c37141b82aa118eaf05061bb9ba1759700
< 4f041c9d6e61829310eb0715d8edb2a232478123
< 4feb6e6d035d5d66984957c8ca22bc9a05df527f
< 6bf9d564856c76a54147d313decd81d1b3445d7d
< 06bf874bbca0a5c600b210b5db920eff9f95f0d0
< 6d7d0eba6d95fd5122b2d2a52f77da510bfefb3b
< 6ebc2b25611ea1e382bedbf6f6af1ac7a6488bae
< 7.55.0-r0
< 8da5da9b6544337b8a675db092da201f279265d4
< 8f995e2e0022292374fc99a2277069b08ad98b5c
< 9ce2d7001939b795b45a8ce7700d1a3dcde0475d
< 9ce6d0d52821c6e33506cb173f0e27c68014e60e
< 11a7ac0d6a84290001a5239df37bbca4270b17d4
< 25df50aa3392ecdbf2b8256b93b30558e8b3a810
< 30c85c327bf7c6980a10558c4504031791194c09
< 33c02d47711c81087d232c7e0e66b74ab61c14d5
< 38e07886ed2792988217a2ffa482ce3a69ca92c2
< 042cc1f69ec0878f542667cb684378869f859911
< 44b9b4d4f56d6f6de92c89636994c03984e9cd01
< 54b636f14546d3fde9f9c67c3b32701d78563161
< 64c613c27abb58503eb8a966bee1489562060da0
< 67fe54d918a3b42a24cb7f5db81514c10e239735
< 79e63a53bb9598af863b0afe49ad662795faeef4
< 80d241046e404233537ff35efabb703a0668c7d5
< 85c710e11e7a7c1caf02962bbbdc08a5561ae769
< 95c717bbd9c327c38b4efcc37d5cda29b8ee2a36
< 95ddbdb1dbfbb051d67bf0d6643b1a917a4c7d88
< 96cec4dfd7daa3ff87bad2140f28745d8417581e
< 202aa9f7758636730299b86715d924f54468a908
< 303bfc1024d948a5ba134ccfc106f82c0b4fd675
< 719bec26063e34a111053efa9fadaa14b17ac42b
< 827f0a318cdbf73800c2366cf6a3132f2b2a7c49
< 0966b324d911423c81351fb12e9219f71cd63be8
< 6247b6d4685beee6362f76664bb50963d40e651d
< 7010e5ea845bd0f9cd377cd60573a5d3d34f6585
< 8249b0522d371679f2cd2516045a5f938ea36a53
< 8548c2fc61c153075c4edcf9b810132803f4d612
< 8986c86e1ef297e95518ae4695339f2d64d913cf
< 9819cec61b00cc872136ea5faf469627b3b87e69
< 22691f849ac959ffaa821a3ca7f746ee54bd5e52
< 70812c2f32fc5734bcbbe572b9f61c380433ad6a
< 81219e80309fc21d379760a3852a832a73204215
< 323273382c9205b71a1b4e97d136da6b2d2f64c0
< a5ee8d50c3faf1359f039c87a3d2dfee9f45d566
< a6ba9e5ccd782d986f6dc5e74ec2ba8ad49be7be
< a7b98f5f6b8e4abbaf32314f68b1e43948df2271
< a8e063b0877da005342b3445c5535a5bce0d5bc5
< a7135ac3c3d825ec9f4919ee0212434e01e76b4c
< b8d006b9d79e8ba726a14b55b6e26f9883f3ecee
< b9fdb721f2948487fcffe34ad60790a83379e1b9
< b238e0b1b4e8f3e5c4e9c0d7d8c565e3776b0999
< b9660dc4b290781ff6535dec32258ec14e6ff0b5
< b122959c8b78b5359184f30c4fb2c86d2b6d7594
< bdd731177ed9db37eab4d9f594f24491ef2fe438
< bf633a584dcbb0f80273ba856b7198ad1e395315
< c1babfad8a98a5fe28e2106d95e1bd7eeafcdb46
< c7e9e60b05b0c3f2f09570cb3089faf58ea51d49
< c262c35676a2c3240da433e7a4428ac2129b445f
< cf93a7b364a70b56150cf6ea77492b799ec02a45
< d957e2189fdc73cef0ff3d1fb58043d354754449
< d37145834876308121d3e825c85b08bec0b3ff97
< df5169fa35f31ebe10893f2a3416ec8e8d8faa20
< e2ae32ff5f3ab6f0819590f61f248f17df12987f
< e91d167ff8cb89523447680e3560f60d93615055
< ef442d58039106eee596d09dd47e2bd6aa1ec032
< f2cb3a01192d36395d16acec6cdb93446ca6fd45
< f2f07dad3451d1f63b56d3de0b43160c39d275d7
< f49df54a36a39995be32782154f3ca2692f17ac4
< f77e89c5d20db09eaebf378ec036a7e796932810
< ff837422ee4ec7d6aea7750a40e30cba29db93e8
Fixed in 7.55.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Curl is a widely used open-source tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and TFTP. The vulnerability, CVE-2017-1000100, affects the TFTP functionality of curl. TFTP (Trivial File Transfer Protocol) is a simple file transfer protocol often used for network booting and transferring small files. The vulnerability arises when curl is provided with a TFTP URL containing an excessively long file name. The file name is truncated to fit within buffer boundaries, but the buffer size is not correctly updated. This can lead to a buffer overflow, allowing a malicious server to read beyond the end of the heap-based buffer and potentially access sensitive information from the client's memory.
Vulnerability Detail
The vulnerability, CVE-2017-1000100, in curl's TFTP functionality allows a malicious HTTP(S) server to redirect a vulnerable client to a crafted TFTP URL. If the client has not restricted which protocols it allows redirects to, it can be tricked into sending private memory contents to a remote server over UDP. The issue arises due to incorrect buffer size calculation when handling long file names in TFTP URLs. By exploiting this vulnerability, an attacker could potentially access sensitive information from the client's memory.
How To Fix
Minimum fixed version
7.55.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can restrict the protocols allowed for redirects in curl using the --proto-redir option or by setting the CURLOPT_REDIR_PROTOCOLS option in libcurl. By limiting the allowed protocols, users can prevent the exploitation of this vulnerability through malicious redirects.
Conclusion
The vulnerability CVE-2017-1000100 in curl's TFTP functionality can be mitigated by updating the curl package to the latest version. Additionally, users can apply workarounds to restrict the protocols allowed for redirects. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
Curl is an open-source tool and library for transferring data with URLs. It supports various protocols, including HTTP, HTTPS, FTP, and TFTP.
TFTP (Trivial File Transfer Protocol) is a simple file transfer protocol often used for network booting and transferring small files.
The vulnerability allows a malicious server to read beyond the end of the heap-based buffer in curl's TFTP functionality. This can potentially lead to the exposure of sensitive information from the client's memory.
To fix this vulnerability, update the curl package to version 7.55.0-r0 or later. This update includes a fix for the buffer overflow issue in the TFTP functionality.
Yes, users can restrict the protocols allowed for redirects in curl using the --proto-redir option or by setting the CURLOPT_REDIR_PROTOCOLS option in libcurl.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
