cURL/libcURL 'curl_easy_unescape()' Heap Memory Corruption Vulnerability

Bugtraq ID:	60737
Class:	Boundary Condition Error
CVE:	CVE-2013-2174
Remote:	Yes
Local:	No
Published:	Jun 22 2013 12:00AM
Updated:	Jul 29 2016 12:00AM
Credit:	Timo Sirainen
Vulnerable:	Ubuntu Ubuntu Linux 13.04 Ubuntu Ubuntu Linux 12.10 i386 Ubuntu Ubuntu Linux 12.10 amd64 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE openSUSE Build Service 2.0 Slackware Linux x86_64 -current Slackware Linux 14.0 x86_64 Slackware Linux 14.0 Slackware Linux 13.37 x86_64 Slackware Linux 13.37 Slackware Linux 13.1 x86_64 Slackware Linux 13.1 Slackware Linux 13.0 x86_64 Slackware Linux 13.0 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux -current S.u.S.E. openSUSE 12.3 S.u.S.E. openSUSE 12.2 S.u.S.E. openSUSE 11.4 Redhat Enterprise Linux Workstation 6 Redhat Enterprise Linux Server 6 Redhat Enterprise Linux HPC Node Optional 6 Redhat Enterprise Linux HPC Node 6 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop Optional 6 Redhat Enterprise Linux Desktop 6 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux 5 Server Oracle VM Server for x86 3.4 Oracle VM Server for x86 3.3 Oracle VM Server for x86 3.2 Oracle Solaris 11.1 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Mandriva Business Server 1 X86 64 Mandriva Business Server 1 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 IBM System x3950 X6 Type 3837 0 IBM System x3850 X6 Type 3837 0 IBM System X3750 M4 8752 IBM System x3650 M4 Type 7915 0 IBM System x3650 M4 HD 5460 IBM System x3630 M4 HD 5466 IBM System X3630 M4 7158 IBM System x3570 M4 type 8733 0 IBM System x3570 M4 type 8722 0 IBM System x3570 M4 type 8718 0 IBM System X3550 M4 7914 IBM System X3530 M4 7160 IBM System X3500 M4 7383 IBM System x3300 M4 7382 IBM System x3250 M5 type 5458 0 IBM System X3250 M4 2583 IBM System x3100 M5 type 5457 0 IBM System X3100 M4 2582 IBM Security Network Intrusion Prevention System GX7800 IBM Security Network Intrusion Prevention System GX7412-10 IBM Security Network Intrusion Prevention System GX7412-05 IBM Security Network Intrusion Prevention System GX7412 IBM Security Network Intrusion Prevention System GX6116 IBM Security Network Intrusion Prevention System GX5208-v2 IBM Security Network Intrusion Prevention System GX5208 IBM Security Network Intrusion Prevention System GX5108-v2 IBM Security Network Intrusion Prevention System GX5108 IBM Security Network Intrusion Prevention System GX5008-v2 IBM Security Network Intrusion Prevention System GX5008 IBM Security Network Intrusion Prevention System GX4004-v2 IBM Security Network Intrusion Prevention System GX4004 IBM Security Network Intrusion Prevention System GX4002 IBM Security Network Intrusion Prevention System GX3002 IBM Security Network Intrusion Prevention System GV200 IBM Security Network Intrusion Prevention System GV1000 IBM NeXtScale nx360 M4 type 5455 0 IBM iDatplex dx360 M4 Water Cooled type 7919 0 IBM iDatplex dx360 M4 Water Cooled type 7918 0 IBM iDatplex dx360 M4 type 7913 0 IBM iDatplex dx360 M4 type 7912 0 IBM Flex System x880 Compute Node 7903 IBM Flex System x880 Compute Node 4259 IBM Flex System X440 Compute Node 7917 IBM Flex System X240 Compute Node 8956 IBM Flex System X240 Compute Node 8738 IBM Flex System X240 Compute Node 8737 IBM Flex System X240 Compute Node 7863 IBM Flex System x222 Compute Node 7916 IBM Flex System X220 Compute Node 7906 IBM Flex System X220 Compute Node 2585 IBM Flex System Manager Node 8734 IBM Flex System Manager Node 8731 IBM Flex System Manager Node 7955 IBM Flex System Manager 1.3.2 0 IBM Flex System Manager 1.2.1 IBM Flex System Manager 1.2 IBM Flex System Manager 1.1 IBM Flex System Manager 1.3.1 IBM Flex System Manager 1.3.0.1 IBM Flex System Manager 1.3.0 IBM Chassis Management Module 2PETE6L IBM Chassis Management Module 2PETE5O IBM Chassis Management Module 2PET12R IBM Chassis Management Module 2PET12P IBM Chassis Management Module 2PET12O IBM Chassis Management Module 2PET12K IBM Chassis Management Module 2PET12I IBM Chassis Management Module 2PET12H IBM Chassis Management Module 2PET12G IBM Chassis Management Module 2PET12F IBM Chassis Management Module 2PET12E IBM Chassis Management Module 2PET12D IBM Chassis Management Module 2PET10Q IBM Chassis Management Module 2PET10P IBM Chassis Management Module 2PET10M IBM Chassis Management Module 2PET10K IBM Chassis Management Module 2PET10I IBM Chassis Management Module 2PET10H IBM Chassis Management Module 2PET10G IBM Chassis Management Module 2PET10F IBM Chassis Management Module 2PET10E IBM Chassis Management Module 2PET10D IBM Chassis Management Module 2PET10C IBM Chassis Management Module 2PET10B IBM Chassis Management Module 2PET10A IBM Chassis Management Module 2PEO12R IBM Chassis Management Module 2PEO12P IBM Chassis Management Module 2PEO12O IBM Chassis Management Module 2PEO12I IBM Chassis Management Module 2PEO12E IBM BladeCenter Advanced Management Module 3.66G Gentoo Linux Daniel Stenberg curl 7.30 Daniel Stenberg curl 7.20 Daniel Stenberg curl 7.19.6 Daniel Stenberg curl 7.19.5 Daniel Stenberg curl 7.19.4 Daniel Stenberg curl 7.19.3 Daniel Stenberg curl 7.19 Daniel Stenberg curl 7.18.1 Daniel Stenberg curl 7.18 Daniel Stenberg curl 7.17 Daniel Stenberg curl 7.16.4 Daniel Stenberg curl 7.15.5 Daniel Stenberg curl 7.15.3 Daniel Stenberg curl 7.15.2 Daniel Stenberg curl 7.15.1 Daniel Stenberg curl 7.15 Daniel Stenberg curl 7.14.1 Daniel Stenberg curl 7.14 Daniel Stenberg curl 7.13.2 Daniel Stenberg curl 7.13.1 Daniel Stenberg curl 7.13 Daniel Stenberg curl 7.12.3 Daniel Stenberg curl 7.12.2 Daniel Stenberg curl 7.12.1 Daniel Stenberg curl 7.12 Daniel Stenberg curl 7.11.2 Daniel Stenberg curl 7.11.1 Daniel Stenberg curl 7.11 Daniel Stenberg curl 7.10.8 Daniel Stenberg curl 7.10.7 Daniel Stenberg curl 7.10.6 Daniel Stenberg curl 7.10.5 Daniel Stenberg curl 7.10.4 Daniel Stenberg curl 7.10.3 Daniel Stenberg curl 7.10.2 Daniel Stenberg curl 7.10.1 Daniel Stenberg curl 7.10 Daniel Stenberg curl 7.9.8 Daniel Stenberg curl 7.9.7 Daniel Stenberg curl 7.9.6 Daniel Stenberg curl 7.9.5 Daniel Stenberg curl 7.9.4 Daniel Stenberg curl 7.9.3 Daniel Stenberg curl 7.9.2 Daniel Stenberg curl 7.9.1 Daniel Stenberg curl 7.9 Daniel Stenberg curl 7.8.2 Daniel Stenberg curl 7.8.1 Daniel Stenberg curl 7.8 Daniel Stenberg curl 7.7.3 Daniel Stenberg curl 7.7.2 Daniel Stenberg curl 7.7.1 Daniel Stenberg curl 7.7 Daniel Stenberg curl 7.2.1 Daniel Stenberg curl 7.2 Daniel Stenberg curl 7.29.0 Daniel Stenberg curl 7.28.1 Daniel Stenberg curl 7.28.0 Daniel Stenberg curl 7.27.0 Daniel Stenberg curl 7.26.0 Daniel Stenberg curl 7.24.0 Daniel Stenberg curl 7.23.1 Daniel Stenberg curl 7.20.2 Daniel Stenberg curl 7.20.1 Daniel Stenberg curl 7.16.3 CentOS CentOS 6 Avaya Voice Portal 5.1.3 Avaya Voice Portal 5.1.2 Avaya Voice Portal 5.1.1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 Avaya Proactive Contact 5.1 Avaya Proactive Contact 5.0 Avaya one-X Client Enablement Services 6.2 Avaya one-X Client Enablement Services 6.1.2 Avaya one-X Client Enablement Services 6.1.1 Avaya one-X Client Enablement Services 6.1 Avaya one-X Client Enablement Services 6.0 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 Avaya IQ 5.2 Avaya IQ 5.1.1 Avaya IQ 5.1 Avaya IQ 5 Avaya IP Office Server Edition 8.1 Avaya IP Office Server Edition 8.0 Avaya IP Office Application Server 8.1 Avaya IP Office Application Server 8.0 Avaya Communication Server 1000M Signaling Server 7.6 Avaya Communication Server 1000M Signaling Server 7.5 Avaya Communication Server 1000M Signaling Server 7.0 Avaya Communication Server 1000M Signaling Server 6.0 Avaya Communication Server 1000M 7.6 Avaya Communication Server 1000M 7.5 Avaya Communication Server 1000M 7.0 Avaya Communication Server 1000M 6.0 Avaya Communication Server 1000E Signaling Server 7.6 Avaya Communication Server 1000E Signaling Server 7.5 Avaya Communication Server 1000E Signaling Server 7.0 Avaya Communication Server 1000E Signaling Server 6.0 Avaya Communication Server 1000E 7.6 Avaya Communication Server 1000E 7.5 Avaya Communication Server 1000E 7.0 Avaya Communication Server 1000E 6.0 Avaya CMS r17 Avaya Aura System Platform 6.2.2 Avaya Aura System Platform 6.2.1 Avaya Aura System Platform 6.0.2 Avaya Aura System Platform 6.0.1 Avaya Aura System Platform 6.3 Avaya Aura System Platform 6.2.1.0.9 Avaya Aura System Platform 6.2 Avaya Aura System Platform 6.0.3.9.3 Avaya Aura System Platform 6.0.3.8.3 Avaya Aura System Platform 6.0.3.0.3 Avaya Aura System Platform 6.0 Avaya Aura System Platform 1.1 Avaya Aura System Platform 1.0 Avaya Aura System Manager 6.3.2 Avaya Aura System Manager 6.3.1 Avaya Aura System Manager 6.3 Avaya Aura System Manager 6.2.3 Avaya Aura System Manager 6.2 Avaya Aura System Manager 6.1.5 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 Avaya Aura System Manager 6.0 Avaya Aura System Manager 5.2 Avaya Aura System Manager 5.0 Avaya Aura Session Manager 6.3.1 Avaya Aura Session Manager 6.2.1 Avaya Aura Session Manager 6.1.5 Avaya Aura Session Manager 6.1.3 Avaya Aura Session Manager 6.1.2 Avaya Aura Session Manager 6.1.1 Avaya Aura Session Manager 6.0.1 Avaya Aura Session Manager 6.3 Avaya Aura Session Manager 6.2.3 Avaya Aura Session Manager 6.2.2 Avaya Aura Session Manager 6.2 Avaya Aura Session Manager 6.1 Avaya Aura Session Manager 6.0.2 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2.1 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 5.0 Avaya Aura Session Manager 1.1.1 Avaya Aura Session Manager 1.1 Avaya Aura Session Manager 1.0 Avaya Aura Presence Services 6.1.2 Avaya Aura Presence Services 6.1.1 Avaya Aura Presence Services 6.2 Avaya Aura Presence Services 6.1 Avaya Aura Presence Services 6.0 Avaya Aura Messaging 6.1.1 Avaya Aura Messaging 6.2 Avaya Aura Messaging 6.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Messaging 6.0.1 Avaya Aura Messaging 6.0 Avaya Aura Experience Portal 6.0.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Experience Portal 6.0.1 Avaya Aura Experience Portal 6.0 Avaya Aura Conferencing 7.0 Avaya Aura Communication Manager Utility Services 6.3 Avaya Aura Communication Manager Utility Services 6.2.5.0.15 Avaya Aura Communication Manager Utility Services 6.2.4.0.15 Avaya Aura Communication Manager Utility Services 6.2 Avaya Aura Communication Manager Utility Services 6.1.0.9.8 Avaya Aura Communication Manager Utility Services 6.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Communication Manager Utility Services 6.0 Avaya Aura Communication Manager 5.2 Avaya Aura Communication Manager 6.3 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Communication Manager 6.2 Avaya Aura Communication Manager 6.0.1 Avaya Aura Communication Manager 6.0 Avaya Aura Application Server 5300 SIP Core 3.0 PB5 Avaya Aura Application Server 5300 SIP Core 3.0 PB3 Avaya Aura Application Server 5300 SIP Core 3.0 Avaya Aura Application Server 5300 SIP Core 2.1 Avaya Aura Application Server 5300 SIP Core 2.0 PB28 Avaya Aura Application Server 5300 SIP Core 2.0 PB26 Avaya Aura Application Server 5300 SIP Core 2.0 PB25 Avaya Aura Application Server 5300 SIP Core 2.0 PB23 Avaya Aura Application Server 5300 SIP Core 2.0 PB19 Avaya Aura Application Server 5300 SIP Core 2.0 PB16 Avaya Aura Application Server 5300 SIP Core 2.0 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 6.2 Avaya Aura Application Enablement Services 6.1.2 Avaya Aura Application Enablement Services 6.1.1 Avaya Aura Application Enablement Services 6.1 Avaya Aura Application Enablement Services 6.0 Avaya Aura Application Enablement Services 5.2.4 Avaya Aura Application Enablement Services 5.2.3 Avaya Aura Application Enablement Services 5.2.2 Avaya Aura Application Enablement Services 5.2 Avaya Aura Application Enablement Services 5.0
Not Vulnerable:	Oracle Solaris 11.1.18.5.0 IBM Chassis Management Module 2.5.3T [2PET12T] Daniel Stenberg curl 7.31

cURL/libcURL 'curl_easy_unescape()' Heap Memory Corruption Vulnerability

cURL/libcURL is prone to a heap-memory-corruption vulnerability because it fails to properly perform bounds check on user-supplied data.

Attackers can exploit this issue to execute arbitrary code in the context of the affected application or cause denial-of-service conditions; other attacks may also be possible.

cURL versions 7.7 through 7.30.0 are vulnerable.

cURL/libcURL 'curl_easy_unescape()' Heap Memory Corruption Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

cURL/libcURL 'curl_easy_unescape()' Heap Memory Corruption Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.


Slackware Linux 12.2

• Slackware curl-7.19.6-i486-2_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ curl-7.19.6-i486-2_slack12.2.tgz

Slackware Linux 14.0 x86_64

• Slackware curl-7.29.0-x86_64-3_slack14.0.txz
  ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/package s/curl-7.29.0-x86_64-3_slack14.0.txz

MandrakeSoft Enterprise Server 5

• Mandriva curl-7.19.0-2.7mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva curl-examples-7.19.0-2.7mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libcurl-devel-7.19.0-2.7mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/


• Mandriva libcurl4-7.19.0-2.7mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/downloads/

Slackware Linux 13.37

• Slackware curl-7.21.4-i486-2_slack13.37.txz
  ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages /curl-7.21.4-i486-2_slack13.37.txz

cURL/libcURL 'curl_easy_unescape()' Heap Memory Corruption Vulnerability

References:

• cURL homepage (Daniel Stenberg )
  
• CVE-2013-2174 Buffer Errors vulnerability in libcurl (Oracle)
  
• Vulnerabilities in curl affect IBM Chassis Management Module (CMM) (CVE-2013-45 (IBM)
  
• curl security update (RHSA-2013-0983) (Avaya)
  
• ecurity Bulletin: Vulnerabilities in curl affect IBM Flex System Manager (FSM): (IBM)
  
• libcurl URL decode buffer boundary flaw (Timo Sirainen)
  
• Oracle VM Server for x86 Bulletin - July 2016 (Oracle)
  
• Security Bulletin: Multiple vulnerabilities in Open SSL, OpenSSH and curl affect (IBM)
  
• Security Bulletin: Network Intrusion Prevention System is affected by curl and p (IBM)
  
• Security Bulletin: Vulnerabilities affect IBM's AMM (IBM)