bagder: curl-www/docs Makefile, 1.69, 1.70 _adv_20100209.html, NONE, 1.1 _security.html, 1.25, 1.26 adv_20100209.txt, NONE, 1.1 vuln.pm, 1.3, 1.4

Update of /cvsroot/curl/curl-www/docs
In directory giant.haxx.se:/var/tmp/cvs-serv14102

Modified Files:
	Makefile _security.html vuln.pm 
Added Files:
	_adv_20100209.html adv_20100209.txt 
Log Message:
libcurl data callback excessive length


Index: _security.html
===================================================================
RCS file: /cvsroot/curl/curl-www/docs/_security.html,v
retrieving revision 1.25
retrieving revision 1.26
diff -u -d -r1.25 -r1.26
--- _security.html	19 Oct 2009 20:23:52 -0000	1.25
+++ _security.html	9 Feb 2010 09:30:34 -0000	1.26
@@ -38,6 +38,27 @@
  See also the <a href="vulnerabilities.html">Vulnerabilties Table</a> to see
  what versions that are vulnerable to what flaws.
 
+<a name="20100209"></a>
+SUBTITLE(libcurl data callback excessive length)
+<p>
+<table class="secbox">
+  <tr><td>Date:</td><td>February 9, 2010</td></tr>
+  <tr><td>ID</td><td><small><a href="#20100209">(permalink)</a></small></td></tr>
+  <tr><td>Affected versions</td><td>7.10.5 to and including 7.19.7</td></tr>
+  <tr><td>Not affected versions</td><td>libcurl <= 7.10.4 and >= 7.20.0</td></tr>
+  <tr><td>Patch</td><td><a href="http://curl.haxx.se/libcurl-contentencoding.patch">libcurl-contentencoding.patch</a></td></tr>
+
+  <tr><td>Advisories</td><td>
+<a href="adv_20100209.html">Project cURL Security Advisory</a> </td></tr>
+
+</table>
+<p>
+ When downloading compressed content over HTTP and the app as asked libcurl to
+ automatically uncompress it with the CURLOPT_ENCODING option, libcurl could
+ wrongly provide the callback with more data than what the maximum documented
+ amount. An application could thus get tricked into badness if the maximum
+ limit was trusted to be enforced by libcurl itself (as it is documented).
+
 <a name="20090812"></a>
 SUBTITLE(libcurl embedded zero in cert name)
 <p>

--- NEW FILE: adv_20100209.txt ---
                    libcurl data callback excessive length
                    ======================================

Project cURL Security Advisory, February 9th 2010
http://curl.haxx.se/docs/security.html

1. VULNERABILITY

  When downloading data, libcurl hands it over to the application using a
  callback that is registered by the client software. libcurl will then call
  that function repeatedly with data until the transfer is complete. The
  callback is documented to receive a maximum data size of 16K
  (CURL_MAX_WRITE_SIZE).

  Using the affected libcurl version to download compressed content over HTTP,
  an application can ask libcurl to automatically uncompress data. When doing
  so, libcurl can wrongly send data up to 64K in size to the callback which
  thus is much larger than the documented maximum size. An application that
  blindly trusts libcurl's max limit for a fixed buffer size or similar is
  then a possible target for a buffer overflow vulnerability.

  This error is only present in zlib-enabled builds of libcurl and only if
  automatic decompression has been explicitly enabled by the application - it
  is disabled by default.

  There is no known exploit for this problem and we have not found any libcurl
  client software that is vulnerable to this flaw - but we acknowledge that
  there may still be vulnerable software in existence.
  
2. AFFECTED VERSIONS

  Affected versions: curl and libcurl 7.10.5 to and including 7.19.7
  Not affected versions: curl and libcurl <= 7.10.4 and >= 7.20.0

  If you build curl or libcurl to not use zlib or make your app not tell
  libcurl to do this magic, you are not affected.

  Also note that (lib)curl is used by many applications, and not always
  advertised as such.

3. THE SOLUTION

  libcurl 7.20.0 makes sure that the length argument in the callback never
  exceeds the documented max length.

4. RECOMMENDATIONS

  We suggest you take one of the following actions immediately, in order of
  preference:

  A - Upgrade to curl and libcurl 7.20.0

  B - Apply this patch and rebuild

      http://curl.haxx.se/libcurl-contentencoding.patch

  C - Disable automatic content encoding decompression in your application

  D - Rebuild curl without zlib support


5. TIME LINE

  We were notified by Wesley Miaw on January 9th, 2010.

  We discussed solutions and a first patch was written and tested on January
  9th.

  Vendor-sec was informed on January 10th, 2010.

  curl 7.20.0 was released on February 9th 2010, just before this flaw was
  publicly disclosed.

6. CREDITS

  Reported to us by Wesley Miaw. Thanks a lot!

  Daniel Stenberg wrote the primary patch and this advisory

Index: vuln.pm
===================================================================
RCS file: /cvsroot/curl/curl-www/docs/vuln.pm,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -d -r1.3 -r1.4
--- vuln.pm	12 Aug 2009 09:17:02 -0000	1.3
+++ vuln.pm	9 Feb 2010 09:30:34 -0000	1.4
@@ -1,5 +1,6 @@
 # datestamp, first vulnerable version, last vulnerable version
 @vuln = (
+    "20100209|7.10.5|7.19.7|libcurl data callback excessive length",
     "20090812|7.4   |7.19.5|libcurl embedded zero in cert name",
     "20090303|5.11  |7.19.3|libcurl Arbitrary File Access",
     "20070710|7.14.0|7.16.3|libcurl GnuTLS insufficient cert verification",

Index: Makefile
===================================================================
RCS file: /cvsroot/curl/curl-www/docs/Makefile,v
retrieving revision 1.69
retrieving revision 1.70
diff -u -d -r1.69 -r1.70
--- Makefile	12 Aug 2009 09:08:48 -0000	1.69
+++ Makefile	9 Feb 2010 09:30:34 -0000	1.70
@@ -21,7 +21,8 @@
  knownbugs.html manual.html caextract.html programs.html security.html	 \
  testcurl.html runtests.html libs.html adv_20051013.html adv_20051207.html \
  adv_20060320.html vulnerabilities.html adv_20070710.html \
- gsoc2008.html releases.html adv_20090303.html releases.csv adv_20090812.html
+ gsoc2008.html releases.html adv_20090303.html releases.csv adv_20090812.html \
+ adv_20100209.html
 
 all: $(PAGES)
 	@echo done 
@@ -240,6 +241,12 @@
 adv_20090812.t: adv_20090812.txt
 	$(TXT2PLAIN) < $< > $@
 
+adv_20100209.html: _adv_20100209.html adv_20100209.t $(MAINPARTS)
+	$(ACTION)
+
+adv_20100209.t: adv_20100209.txt
+	$(TXT2PLAIN) < $< > $@
+
 vulnerabilities.html: _vulnerabilities.html vuln.txt $(MAINPARTS)
 	$(ACTION)
 

--- NEW FILE: _adv_20100209.html ---
#include "_doctype.html"
<HTML>
<HEAD> <TITLE>cURL - Security Advisory (February 9, 2010)</TITLE>
#include "css.t"
#include "manpage.t"
</HEAD>

#define CURL_DOCS
#define CURL_URL docs/adv_20100209.html

#include "_menu.html"
#include "setup.t"

WHERE3(Docs, "/docs/", Security, "/docs/security.html", Advisory)

TITLE(Security Advisory February 9 2010)
<div class="relatedbox">
<b>Related:</b>
<br><a href="manual.html">Manual</a>
<br><a href="faq.html">FAQ</a>
<br><a href="/changes.html">Changelog</a>
<br><a href="http://www.gnu.org/software/gnutls/security.html">GnuTLS sec</a>
</div>

<pre>
#include "adv_20100209.t"
</pre>

#include "_footer.html"
</body> </html>