[UNIX] Multiple Vulnerabilities in cURL/libcURL (Kerberos Authentication, NTLM Authentication)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Multiple Vulnerabilities in cURL/libcURL (Kerberos Authentication, NTLM 
Authentication)
------------------------------------------------------------------------


SUMMARY

 <http://curl.haxx.se/> cURL is "a command line tool for transferring 
files with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, 
DICT, FILE and LDAP".

Remote exploitation of a stack-based buffer overflow in various UNIX/Linux 
vendors' implementation of cURL could allow for arbitrary code execution 
on the targeted host.

DETAILS

Vulnerable Systems:
 *  cURL version 7.3 up to 7.13.0 inclusive

Immune Systems:
 * cURL version 7.13.1 or newer

Kerberos Authentication Buffer Overflow:
An exploitable stack-based buffer overflow condition exists when using 
Kerberos authentication. The problem specifically exists within the 
functions Curl_krb_kauth() and krb4_auth() defined in lib/krb4.c. Within 
these functions a statically allocated stack-based buffer of size 1250, 
from struct KTEXT_ST.dat, is passed to the Curl_base64_decode() routine 
defined in lib/base64.c:

Code Snips:
    len = Curl_base64_decode(p, (char *)adat.dat);
    tmp = Curl_base64_decode(p, (char *)tkt.dat);

The Curl_base64_decode() routine relies on the calling function to 
validate the decoded length. This function base64 decodes and copies data 
directly from the HTTP reply of a server to the destination buffer, in 
this case buffer[]. An attacker can construct a long base64 encoded 
malicious payload that upon decoding will overflow the static buffer and
overwrite the saved EIP. This in turn can lead to arbitrary code 
execution.

 NTLM Authentication Buffer Overflow:
An exploitable stack-based buffer overflow condition exists when using NT 
Lan Manager (NTLM) authentication. The problem specifically exists within 
Curl_input_ntlm() defined in lib/http_ntlm.c. Within this function an 
unsigned stack-based character array of size 256, buffer[], is passed to 
the Curl_base64_decode() routine defined in lib/base64.c.

Code Snips:
    size_t size = Curl_base64_decode(header, (char *)buffer);

The Curl_base64_decode() routine relies on the calling function to 
validate the decoded length. This function base64 decodes and copies data 
directly from the HTTP reply of a server to the destination buffer, in 
this case buffer[]. An attacker can construct a long base64 encoded 
malicious payload that upon decoding will overflow the 256 byte static
buffer and overwrite the saved EIP. This in turn can lead to arbitrary 
code execution.

Disclosure Timeline:
12/21/2004 - Initial vendor notification - No response
02/10/2005 - Secondary vendor notification - No response
02/21/2005 - Public disclosure


ADDITIONAL INFORMATION

The information has been provided by  
<mailto:[email protected]> idlabs.
The original articles can be found at:  
<http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities and  <http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: [email protected] 
In order to subscribe to the mailing list, simply forward this email to: [email protected] 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any kind. 
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.