CVE-2019-3822
Summary
| CVE | CVE-2019-3822 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2019-02-06 20:29:00 UTC |
|---|
| Updated | 2023-11-07 03:10:00 UTC |
|---|
| Description | libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Debian -- Security Information -- DSA-4386-1 curl |
DEBIAN |
www.debian.org |
Third Party Advisory |
| cURL: Multiple vulnerabilities (GLSA 201903-03) — Gentoo security |
GENTOO |
security.gentoo.org |
Third Party Advisory |
| curl - NTLMv2 type-3 header stack buffer overflow - CVE-2019-3822 |
MISC |
curl.haxx.se |
Patch, Vendor Advisory |
| February 2019 curl/libcurl Vulnerabilities in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
Patch, Third Party Advisory |
| cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf |
CONFIRM |
cert-portal.siemens.com |
Third Party Advisory |
| cURL/libcURL Multiple Buffer Overflow Vulnerabilities |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| 1670254 – (CVE-2019-3822) CVE-2019-3822 curl: NTLMv2 type-3 header stack buffer overflow |
CONFIRM |
bugzilla.redhat.com |
Exploit, Issue Tracking, Patch, Third Party Advisory |
| USN-3882-1: curl vulnerabilities | Ubuntu security notices |
UBUNTU |
usn.ubuntu.com |
Third Party Advisory |
| Pony Mail! |
|
lists.apache.org |
|
| myF5 |
|
support.f5.com |
|
| support.f5.com/csp/article/K84141449 |
CONFIRM |
support.f5.com |
Third Party Advisory |
| Oracle Critical Patch Update - July 2019 |
MISC |
www.oracle.com |
Patch, Third Party Advisory |
| Red Hat Customer Portal |
REDHAT |
access.redhat.com |
Third Party Advisory |
| July 2019 MySQL Vulnerabilities in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
Third Party Advisory |
| support.f5.com/csp/article/K84141449 |
CONFIRM |
support.f5.com |
Third Party Advisory |
| Pony Mail! |
MLIST |
lists.apache.org |
Mailing List, Third Party Advisory |
| Oracle Critical Patch Update Advisory - April 2019 |
MISC |
www.oracle.com |
Patch, Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 377396 Alibaba Cloud Linux Security Update for curl (ALINUX3-SA-2021:0078)
- 500127 Alpine Linux Security Update for curl
- 503782 Alpine Linux Security Update for curl
- 710197 Gentoo Linux cURL Multiple Vulnerabilities (GLSA 201903-03)
