CVE-2018-1000122
RTSP RTP buffer over-read
Project curl Security Advisory, March 14th 2018 - Permalink
VULNERABILITY
curl can be tricked into copying data beyond end of its heap based buffer.
When asked to transfer an RTSP URL, curl could calculate a wrong data length to copy from the read buffer. The memcpy() call would copy data from the heap following the buffer to a storage area that would subsequently be delivered to the application (if it didn't cause a crash). We've managed to get it to reach several hundreds bytes out of range.
This could lead to information leakage or a denial of service for the application if the server offering the RTSP data can trigger this.
INFO
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2018-1000122 to this issue.
CWE-126: Buffer Over-read
Severity: Medium
AFFECTED VERSIONS
- Affected versions: curl 7.20.0 to and including curl 7.58.0
- Not affected versions: curl < 7.20.0 and curl >= 7.59.0
- Introduced-in: https://github.com/curl/curl/commit/bc4582b68a673d3
libcurl is used by many applications, but not always advertised as such.
SOLUTION
In curl version 7.59.0, curl makes sure that this code never gets told to copy more data than it is allowed to read from the buffer.
RECOMMENDATIONS
We suggest you take one of the following actions immediately, in order of preference:
A - Upgrade curl to version 7.59.0
B - Apply the patch to your version and rebuild
TIMELINE
It was reported to the curl project on February 20, 2018
We contacted distros@openwall on March 8, 2018.
curl 7.59.0 was released on March 14 2018, coordinated with the publication of this advisory.
CREDITS
- Reported-by: OSS-fuzz
- Help-by: Max Dymond
- Patched-by: Daniel Stenberg
Thanks a lot!