Heap-based Buffer Overflow Affecting curl package, versions [7.69.0,8.4.0)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-UNMANAGED-CURL-5931782
- published 4 Oct 2023
- disclosed 4 Oct 2023
- credit Jay Satiro
How to fix?
curl to version 8.4.0 or higher.
curl is a command line tool and library for transferring data with URL syntax, supporting DICT, FILE, FTP, FTPS, GOPHER, GOPHERS, HTTP, HTTPS, IMAP, IMAPS, LDAP, LDAPS, MQTT, POP3, POP3S, RTMP, RTMPS, RTSP, SCP, SFTP, SMB, SMBS, SMTP, SMTPS, TELNET and TFTP. libcurl offers a myriad of powerful features.
Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the
SOCKS5 proxy handshake process when the hostname is longer than the target buffer and larger than 255 bytes.
The local variable
socks5_resolve_local could get the wrong value during a slow SOCKS5 handshake.
Since the code wrongly thinks it should pass on the hostname, even though the hostname is too long to fit, the memory copy can overflow the allocated target buffer.
This is only exploitable if the SOCKS5 handshake is slow enough to trigger a local variable bug and the client uses a hostname longer than the download buffer.
Exploiting this vulnerability could allow an attacker to execute arbitrary code on the target system under certain conditions.
An overflow is only possible in applications that don't set
CURLOPT_BUFFERSIZE or set it smaller than 65541.
Since the curl tool sets
CURLOPT_BUFFERSIZE to 100kB by default, it is not vulnerable unless the user sets the rate limiting to a rate smaller than 65541 bytes/second.
The options that cause SOCKS5 with remote hostname to be used in
CURLOPT_PROXYTYPEset to type
CURLOPT_PRE_PROXYset to use the scheme
One of the proxy environment variables can be set to use the
socks5h://scheme. For example,
The options that cause SOCKS5 with remote hostname to be used in the
--preproxyset to use the scheme
Environment variables as described in the libcurl section.
2023-10-04: Initial publication
2023-10-11: Published updated information, including CWE, CVSS, official references and affected versions range.