cURL/libcURL CURLOPT_ENCODING Option Buffer Overflow Vulnerability

Bugtraq ID:	38162
Class:	Boundary Condition Error
CVE:	CVE-2010-0734
Remote:	Yes
Local:	No
Published:	Feb 09 2010 12:00AM
Updated:	Apr 13 2015 10:13PM
Credit:	Wesley Miaw
Vulnerable:	VMWare ESXi Server 4.1 VMWare ESXi Server 4.0 VMWare ESXi Server 3.5 VMWare ESX 4.1 VMWare ESX 4.0 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 LTS Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 rPath rPath Linux 2 rPath Appliance Platform Linux Service 2 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux Desktop version 4 Redhat Enterprise Linux 5 Server Redhat Desktop 3.0 Mandriva Linux Mandrake 2010.0 x86_64 Mandriva Linux Mandrake 2010.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 HP System Management Homepage 6.2.2 7 HP System Management Homepage 6.0 .96 HP System Management Homepage 3.0.2 .77 HP System Management Homepage 3.0.1 .73 HP System Management Homepage 3.0 .68 HP System Management Homepage 3.0 .64 HP System Management Homepage 6.3 HP System Management Homepage 6.2.0-12 HP System Management Homepage 6.2 HP System Management Homepage 6.2 HP System Management Homepage 6.1.0.103 HP System Management Homepage 6.1.0.102 HP System Management Homepage 6.1.0-103 HP System Management Homepage 6.1 HP System Management Homepage 6.0.0.95 HP System Management Homepage 6.0.0-95 HP System Management Homepage 6.0 HP System Management Homepage 3.0.2.77 B HP System Management Homepage 3.0.2-77 HP System Management Homepage 3.0.1-73 HP System Management Homepage 3.0.0-68 HP System Management Homepage 0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Daniel Stenberg curl 7.19.6 Daniel Stenberg curl 7.19.5 Daniel Stenberg curl 7.19.4 Daniel Stenberg curl 7.19.3 Daniel Stenberg curl 7.19 Daniel Stenberg curl 7.18.1 Daniel Stenberg curl 7.18 Daniel Stenberg curl 7.17 Daniel Stenberg curl 7.16.4 Daniel Stenberg curl 7.15.5 Daniel Stenberg curl 7.15.3 Daniel Stenberg curl 7.15.2 Daniel Stenberg curl 7.15.1 Daniel Stenberg curl 7.15 Daniel Stenberg curl 7.14.1 Daniel Stenberg curl 7.14 Daniel Stenberg curl 7.13.2 Daniel Stenberg curl 7.13.1 Daniel Stenberg curl 7.13 Daniel Stenberg curl 7.12.3 Daniel Stenberg curl 7.12.2 Daniel Stenberg curl 7.12.1 Daniel Stenberg curl 7.12 Daniel Stenberg curl 7.11.2 Daniel Stenberg curl 7.11.1 Daniel Stenberg curl 7.11 Daniel Stenberg curl 7.10.8 Daniel Stenberg curl 7.10.7 Daniel Stenberg curl 7.10.6 Daniel Stenberg curl 7.10.5 Daniel Stenberg curl 7.10.4 Daniel Stenberg curl 7.10.3 Daniel Stenberg curl 7.10.2 Daniel Stenberg curl 7.10.1 Daniel Stenberg curl 7.10 Daniel Stenberg curl 7.9.8 Daniel Stenberg curl 7.9.7 Daniel Stenberg curl 7.9.6 Daniel Stenberg curl 7.9.5 Daniel Stenberg curl 7.9.4 Daniel Stenberg curl 7.9.3 Daniel Stenberg curl 7.9.2 Daniel Stenberg curl 7.9.1 Daniel Stenberg curl 7.9 Daniel Stenberg curl 7.8.2 + Redhat Advanced Workstation for the Itanium Processor 2.1 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 IA64 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 IA64 + Redhat Enterprise Linux WS 2.1 Daniel Stenberg curl 7.8.1 Daniel Stenberg curl 7.8 Daniel Stenberg curl 7.7.3 Daniel Stenberg curl 7.7.2 Daniel Stenberg curl 7.7.1 Daniel Stenberg curl 7.7 Daniel Stenberg curl 7.6.1 Daniel Stenberg curl 7.6 Daniel Stenberg curl 7.5.2 Daniel Stenberg curl 7.5.1 Daniel Stenberg curl 7.5 Daniel Stenberg curl 7.4.2 Daniel Stenberg curl 7.4.1 Daniel Stenberg curl 7.4 Daniel Stenberg curl 7.3 Daniel Stenberg curl 7.2.1 Daniel Stenberg curl 7.2 Daniel Stenberg curl 7.1.1 Daniel Stenberg curl 7.1 Daniel Stenberg curl 7.16.3 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 Avaya Voice Portal 4.1 SP2 Avaya Voice Portal 4.1 SP1 Avaya Voice Portal 4.1 Avaya Voice Portal 4.0 Avaya Proactive Contact 4.1.2 Avaya Proactive Contact 4.1.1 Avaya Proactive Contact 4.1 Avaya Proactive Contact 4.0 Avaya Messaging Storage Server 5.2 Avaya Messaging Storage Server 5.1 Avaya Messaging Storage Server 5.0 Avaya Messaging Storage Server 4.0 Avaya Messaging Storage Server 3.1 SP1 Avaya Messaging Storage Server 3.1 Avaya Messaging Storage Server 2.0 Avaya Messaging Storage Server 1.0 Avaya Messaging Storage Server Avaya Message Networking 5.2 Avaya Message Networking 3.1 Avaya Meeting Exchange 5.2 SP1 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 Avaya IQ 5 Avaya Intuity AUDIX LX R1.1 Avaya Intuity AUDIX LX 2.0 SP2 Avaya Intuity AUDIX LX 2.0 SP1 Avaya Intuity AUDIX LX 2.0 Avaya Intuity AUDIX LX 1.0 Avaya Aura System Platform 1.0 Avaya Aura System Manager 5.2 Avaya Aura SIP Enablement Services 5.2.1 Avaya Aura SIP Enablement Services 3.1.1 Avaya Aura SIP Enablement Services 3.1 Avaya Aura SIP Enablement Services 5.2 Avaya Aura SIP Enablement Services 5.1 Avaya Aura SIP Enablement Services 5.0 Avaya Aura SIP Enablement Services 4.0 Avaya Aura SIP Enablement Services 3.1 Avaya Aura SIP Enablement Services 3.0 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Communication Manager 5.2 Avaya Aura Communication Manager 5.1 Avaya Aura Communication Manager 4.0 Avaya Aura Communication Manager 4.0 Avaya Aura Application Enablement Services 4.2.2 Avaya Aura Application Enablement Services 4.2.1 Avaya Aura Application Enablement Services 5.2 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.6 Apple Mac OS X 10.5
Not Vulnerable:	VMWare ESXi Server 4.1 ESXi410-20110120 HP System Management Homepage 7.0 Apple Mac OS X Server 10.6.4 Apple Mac OS X 10.6.4

cURL/libcURL CURLOPT_ENCODING Option Buffer Overflow Vulnerability

cURL/libcURL is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Remote attackers can exploit this issue to execute arbitrary code within the context of the application or crash the application.

Versions prior to cURL/libcURL 7.20.0 are vulnerable.

NOTE: This issue occurs only in the 'zlib-enabled' builds.

cURL/libcURL CURLOPT_ENCODING Option Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

cURL/libcURL CURLOPT_ENCODING Option Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.


Daniel Stenberg curl 7.16.3

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Debian Linux 5.0 alpha

• Debian curl_7.18.2-8lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/curl_7.18.2-8lenny 4_alpha.deb


• Debian libcurl3-dbg_7.18.2-8lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.18. 2-8lenny4_alpha.deb


• Debian libcurl3-gnutls_7.18.2-8lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7. 18.2-8lenny4_alpha.deb


• Debian libcurl3_7.18.2-8lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.18.2-8l enny4_alpha.deb


• Debian libcurl4-gnutls-dev_7.18.2-8lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-gnutls-de v_7.18.2-8lenny4_alpha.deb


• Debian libcurl4-openssl-dev_7.18.2-8lenny4_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-openssl-d ev_7.18.2-8lenny4_alpha.deb

Mandriva Linux Mandrake 2008.0

• Mandriva curl-7.16.4-2.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libcurl-devel-7.16.4-2.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libcurl4-7.16.4-2.3mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 armel

• Debian curl_7.18.2-8lenny4_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/curl_7.18.2-8lenny 4_armel.deb


• Debian libcurl3-dbg_7.18.2-8lenny4_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.18. 2-8lenny4_armel.deb


• Debian libcurl3-gnutls_7.18.2-8lenny4_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7. 18.2-8lenny4_armel.deb


• Debian libcurl3_7.18.2-8lenny4_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.18.2-8l enny4_armel.deb


• Debian libcurl4-gnutls-dev_7.18.2-8lenny4_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-gnutls-de v_7.18.2-8lenny4_armel.deb


• Debian libcurl4-openssl-dev_7.18.2-8lenny4_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-openssl-d ev_7.18.2-8lenny4_armel.deb

Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.4.dmg
  http://www.apple.com/support/downloads/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva curl-7.19.0-2.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva curl-examples-7.19.0-2.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64curl-devel-7.19.0-2.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64curl4-7.19.0-2.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 sparc

• Debian curl_7.18.2-8lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/c/curl/curl_7.18.2-8lenny 4_sparc.deb


• Debian libcurl3-dbg_7.18.2-8lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.18. 2-8lenny4_sparc.deb


• Debian libcurl3-gnutls_7.18.2-8lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7. 18.2-8lenny4_sparc.deb


• Debian libcurl3_7.18.2-8lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.18.2-8l enny4_sparc.deb


• Debian libcurl4-gnutls-dev_7.18.2-8lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-gnutls-de v_7.18.2-8lenny4_sparc.deb


• Debian libcurl4-openssl-dev_7.18.2-8lenny4_sparc.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-openssl-d ev_7.18.2-8lenny4_sparc.deb

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva curl-7.19.4-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva curl-examples-7.19.4-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64curl-devel-7.19.4-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64curl4-7.19.4-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva curl-7.19.0-2.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva curl-examples-7.19.0-2.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libcurl-devel-7.19.0-2.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libcurl4-7.19.0-2.4mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/

Apple Mac OS X 10.6.1

• Apple MacOSXUpdCombo10.6.4.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.3

• Apple MacOSXUpd10.6.4.dmg
  http://www.apple.com/support/downloads/

Daniel Stenberg curl 7.1

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.10

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.10.1

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.10.3

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.10.7

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.10.8

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.11.2

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.13.1

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.14

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.15

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.17

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.2

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.4.2

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.5

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.5.1

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.7.1

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.8.2

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.9.3

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

Daniel Stenberg curl 7.9.7

• Daniel Stenberg libcurl-contentencoding.patch
  http://curl.haxx.se/libcurl-contentencoding.patch

cURL/libcURL CURLOPT_ENCODING Option Buffer Overflow Vulnerability

References:

• cURL Home Page (cURL)
  
• Security Advisory February 9 2010 (cURL)
  
• VMSA-2010-0015 VMware ESX third party updates for Service Console (VMWare)
  
• ASA-2010-126 curl security update (RHSA-2010-0329) (Avaya)
  
• ASA-2010-127 curl security, bug fix and enhancement update (RHSA-2010-0273) (Avaya)