Buffer Overflow Vulnerability in curl
Summary
CVE-2018-1000120: A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse. Affects curl across 2 version ranges.
< 7.59.0-r0
< 61c434273654048462873c031eda027dd4acd549
Fixed in 7.59.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Curl is a widely used open-source tool and library for transferring data with URLs. It supports various protocols, including HTTP, FTP, and SMTP. The vulnerability, known as CVE-2018-1000120, affects curl versions 7.12.3 to 7.58.0. It specifically targets the FTP URL handling functionality of curl. The vulnerability allows an attacker to exploit a buffer overflow, potentially leading to a denial of service or more severe consequences.
Vulnerability Detail
The buffer overflow vulnerability in curl's FTP URL handling can be exploited by an attacker to cause a denial of service or execute arbitrary code. By sending a specially crafted FTP URL, the attacker can trigger the buffer overflow and overwrite adjacent memory, potentially leading to a crash or the execution of malicious code. This vulnerability has a CVSS score of 9.8, indicating its high severity.
How To Fix
Minimum fixed version
7.59.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update curl to the fixed version to mitigate the risk of exploitation.
Conclusion
The buffer overflow vulnerability in curl's FTP URL handling poses a significant risk to systems using affected versions of curl. It is crucial to update to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
Curl is an open-source tool and library for transferring data with URLs. It supports various protocols, including HTTP, FTP, and SMTP.
The vulnerability allows an attacker to exploit a buffer overflow in curl's FTP URL handling, potentially leading to a denial of service or the execution of arbitrary code.
The vulnerability affects curl versions 7.12.3 to 7.58.0.
To fix this vulnerability, update curl to version 7.59.0-r0 or later.
No, there is no known workaround. It is crucial to update curl to the fixed version.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
