CVE-2017-8817 - Read Out of Bounds Flaw in FTP Wildcard Function in libcurl
Summary
DLA-1195-1: curl - security update. Affects curl versions < 7.26.0-1+wheezy23. Fixed in 7.26.0-1+wheezy23. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is curl, a command-line tool and library for transferring data with URLs. It supports various protocols, including HTTP, FTP, and SMTP. libcurl is a client-side URL transfer library used by curl. It provides functions for performing network operations and supports a wide range of features and options. However, a vulnerability has been discovered in the FTP wildcard function of libcurl.
Vulnerability Detail
The vulnerability, identified as CVE-2017-8817, was discovered through fuzzing by the OSS-Fuzz project. It involves a read out of bounds flaw in the FTP wildcard function of libcurl. If a malicious server redirects a libcurl-based client to a URL using a wildcard pattern, it can trigger an out-of-bound read. This could potentially lead to information disclosure or other security issues. The vulnerability affects the Debian 7 Wheezy distribution of curl.
How To Fix
Minimum fixed version
7.26.0-1+wheezy23
This is the first release that contains the fix.
sudo apt-get install --only-upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
In conclusion, the CVE-2017-8817 vulnerability in curl's FTP wildcard function could allow a malicious server to trigger an out-of-bound read. It is recommended to upgrade the curl package to version 7.26.0-1+wheezy23 or later to mitigate this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for curl →
FAQ
The vulnerability could allow a malicious server to read out of bounds, potentially leading to information disclosure or other security issues.
The vulnerability affects curl version 7.26.0-1+wheezy23 and earlier in the Debian 7 Wheezy distribution.
The vulnerability was discovered through fuzzing by the OSS-Fuzz project.
Yes, the vulnerability has been fixed in curl version 7.26.0-1+wheezy23 or later.
You can upgrade your curl package by using the package manager or by manually downloading and installing the updated version from the official Debian repository.
Related vulnerabilities
Recent vulnerabilities recorded for curl.
