Heap Buffer Out-of-Bounds Read Vulnerability in curl Package
Summary
ALPINE-CVE-2018-16890: libcurl versions from 7.36.0 to before 7.64.0 is vulnerable to a heap buffer out-of-bounds read. Affects curl versions < 7.64.0-r0. Fixed in 7.64.0-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
curl is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and more. The curl library is integral for applications that require data transfer capabilities. However, certain versions of curl are susceptible to a critical vulnerability that can lead to security breaches.
Vulnerability Detail
The vulnerability, identified as CVE-2018-16890, affects libcurl versions from 7.36.0 to before 7.64.0. It is caused by improper validation of incoming NTLM type-2 messages, leading to a heap buffer out-of-bounds read. This flaw can be exploited by a malicious or misconfigured NTLM server, allowing an attacker to manipulate the length and offset of the data, resulting in unauthorized memory access. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
7.64.0-r0
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating is not immediately possible, consider disabling NTLM authentication in your application as a temporary workaround. This can be done by configuring your application to use a different authentication method that does not rely on NTLM.
Conclusion
The CVE-2018-16890 vulnerability in the curl package poses a significant risk due to its potential for exploitation via heap buffer out-of-bounds reads. It is crucial for users to update to the patched version of curl to safeguard their applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for curl →
FAQ
CVE-2018-16890 is a vulnerability in the curl package that allows for a heap buffer out-of-bounds read due to improper validation of NTLM type-2 messages.
The vulnerability affects libcurl versions from 7.36.0 to before 7.64.0.
You can use the Vulert playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to memory, potentially allowing attackers to execute arbitrary code or crash the application.
As a temporary measure, consider disabling NTLM authentication in your application to mitigate the risk until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
