bagder: curl-www/docs Makefile,1.55,1.56 adv_20051207.txt,NONE,1.1

Update of /cvsroot/curl/curl-www/docs
In directory labb:/tmp/cvs-serv28217

Modified Files:
	Makefile 
Added Files:
	adv_20051207.txt 
Log Message:
another advisory...


--- NEW FILE: adv_20051207.txt ---
                  libcurl URL Buffer Overflow Vulnerability
                  =========================================

Project cURL Security Advisory, December 7th 2005
http://curl.haxx.se/docs/security.html

1. VULNERABILITY

libcurl's URL parser function can overflow a malloced buffer in two ways, if
given a too long URL.

These overflows happen if you

 1 - pass in a URL with no protocol (like "http://") prefix, using no slash
     and the string is 256 bytes or longer. This leads to a single zero byte
     overflow of the malloced buffer.

 2 - pass in a URL with only a question mark as separator (no slash) between
     the host and the query part of the URL. This leads to a single zero byte
     overflow of the malloced buffer.

Both overflows can be made with the same input string, leading to two single
zero byte overwrites.

The affected flaw cannot be triggered by a redirect, but the long URL must be
passed in "directly" to libcurl. It makes this a "local" problem. Of course,
lots of programs may still pass in user-provided URLs to libcurl without doing
much syntax checking of their own, allowing a user to exploit this
vulnerability.

There is no known exploit at the time of this writing.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CAN-XXXX-XXX to this issue.

2. AFFECTED VERSIONS

Affected versions: curl and libcurl 7.11.2 to and including 7.15.0
Not affected versions: curl and libcurl 7.11.1 and earlier, 7.15.1 and later

Also note that (lib)curl is used by many applications, and not always
advertised as such.

3. RECOMMENDATIONS

We suggest you take one of the following actions immediately:

 I - Upgrade to curl and libcurl 7.15.1

 II - Apply the patch http://curl.haxx.se/libcurl-urllen.patch to your
      libcurl version and install this

 III - Make sure the URLs you pass to libcurl always have a protocol part
       prepended

4. TIME LINE

We were notified by Stefan Esser on November 29th, 2005.

Discussions were held and the patch to fix this flaw was made swiftly.

5. CREDITS

Reported to us by Stefan Esser. Thanks a lot!

Index: Makefile
===================================================================
RCS file: /cvsroot/curl/curl-www/docs/Makefile,v
retrieving revision 1.55
retrieving revision 1.56
diff -u -d -r1.55 -r1.56
--- Makefile	5 Nov 2005 22:23:47 -0000	1.55
+++ Makefile	6 Dec 2005 23:04:07 -0000	1.56
@@ -19,7 +19,7 @@
  thanks.html y2k.html todo.html httpscripting.html comparison-table.html \
  relatedtools.html osdistribs.html versions.html history.html loc.html	 \
  knownbugs.html manual.html caextract.html programs.html security.html	 \
- testcurl.html runtests.html libs.html adv_20051013.html
+ testcurl.html runtests.html libs.html adv_20051013.html adv_20051207.html
 
 all: $(PAGES)
 	@echo done 
@@ -205,6 +205,12 @@
 adv_20051013.t: adv_20051013.txt
 	$(TXT2PLAIN) < $< > $@
 
+adv_20051207.html: _adv_20051207.html adv_20051207.t $(MAINPARTS)
+	$(ACTION)
+
+adv_20051207.t: adv_20051207.txt
+	$(TXT2PLAIN) < $< > $@
+
 
 #archive/index.html: mail
 #	./fixit