Lucene search

K
archlinuxArchLinuxASA-201905-14
HistoryMay 31, 2019 - 12:00 a.m.

[ASA-201905-14] lib32-libcurl-compat: arbitrary code execution

2019-05-3100:00:00
security.archlinux.org
25

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.053

Percentile

93.1%

Arch Linux Security Advisory ASA-201905-14

Severity: High
Date : 2019-05-31
CVE-ID : CVE-2019-5435 CVE-2019-5436
Package : lib32-libcurl-compat
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-962

Summary

The package lib32-libcurl-compat before version 7.65.0-1 is vulnerable
to arbitrary code execution.

Resolution

Upgrade to 7.65.0-1.

pacman -Syu “lib32-libcurl-compat>=7.65.0-1”

The problems have been fixed upstream in version 7.65.0.

Workaround

None.

Description

  • CVE-2019-5435 (arbitrary code execution)

libcurl before 7.65.0 contains two integer overflows in the
curl_url_set() function that if triggered, can lead to a too small
buffer allocation and a subsequent heap buffer overflow. The flaws only
exist on 32 bit architectures and require excessive string input
lengths.

  • CVE-2019-5436 (arbitrary code execution)

libcurl before 7.65.0 contains a heap buffer overflow in the function
(tftp_receive_packet()) that receives data from a TFTP server. It calls
recvfrom() with the default size for the buffer rather than with the
size that was used to allocate it. Thus, the content that might
overwrite the heap memory is entirely controlled by the server.

The flaw exists if the user selects to use a “blksize” of 504 or
smaller (default is 512). The smaller size that is used, the larger the
possible overflow becomes. Users choosing a smaller size than default
should be rare as the primary use case for changing the size is to make
it larger.

Impact

A malicious TFTP server can execute arbitrary code on the affected
host. A remote attacker can execute arbitrary code on the affected host
via a crafted URL part of excessive length.

References

https://curl.haxx.se/docs/CVE-2019-5435.html
https://curl.haxx.se/docs/CVE-2019-5436.html
https://github.com/curl/curl/commit/5fc28510a4664f4
https://github.com/curl/curl/commit/2576003415625d7b5f0e390902f8097830b82275
https://security.archlinux.org/CVE-2019-5435
https://security.archlinux.org/CVE-2019-5436

OSVersionArchitecturePackageVersionFilename
ArchLinuxanyanylib32-libcurl-compat< 7.65.0-1UNKNOWN

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.053

Percentile

93.1%