CVE-2013-0249

🗓️ 08 Mar 2013 22:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 140 Views🌐 WEB

CVE-2013-0249 Stack-based buffer overflow in Curl_sasl_create_digest_md5_message functio

Reporter	Title	Published	Views	Family All 55
zdt	cURL Buffer Overflow Vulnerability	8 Feb 201300:00	–	zdt
Tenable Nessus	cURL/libcURL 'Curl_sasl_create_digest_md5_message()' Stack Buffer Overflow	1 Jul 201300:00	–	nessus
Tenable Nessus	cURL/libcURL 'Curl_sasl_create_digest_md5_message()' Stack Buffer Overflow Vulnerability	1 Jul 201300:00	–	nessus
Tenable Nessus	Fedora 18 : curl-7.27.0-6.fc18 (2013-2098)	25 Feb 201300:00	–	nessus
Tenable Nessus	GLSA-201401-14 : cURL: Multiple vulnerabilities	21 Jan 201400:00	–	nessus
Tenable Nessus	Mac OS X 10.x < 10.9 Multiple Vulnerabilities (BEAST)	23 Oct 201300:00	–	nessus
Tenable Nessus	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	10 Sep 202400:00	–	nessus
Tenable Nessus	Slackware 14.0 / current : curl (SSA:2013-038-01)	8 Feb 201300:00	–	nessus
Tenable Nessus	Ubuntu 12.10 : curl vulnerability (USN-1721-1)	13 Feb 201300:00	–	nessus
BDU FSTEC	Vulnerabilities of the Gentoo Linux operating system, which allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec

NVD

Node

haxx curlMatch7.26.0

haxx curlMatch7.27.0

haxx curlMatch7.28.0

haxx curlMatch7.28.1

haxx libcurlMatch7.26.0

haxx libcurlMatch7.27.0

haxx libcurlMatch7.28.0

haxx libcurlMatch7.28.1

Node

Source	Link
oracle	www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
blog	www.blog.volema.com/curl-rce.html
curl	www.curl.haxx.se/docs/adv_20130206.html
osvdb	www.osvdb.org/89988
securitytracker	www.securitytracker.com/id/1028093
packetstormsecurity	www.packetstormsecurity.com/files/120147/cURL-Buffer-Overflow.html
lists	www.lists.apple.com/archives/security-announce/2013/Oct/msg00004.html
lists	www.lists.fedoraproject.org/pipermail/package-announce/2013-February/099140.html
nakedsecurity	www.nakedsecurity.sophos.com/2013/02/10/anatomy-of-a-vulnerability-curl-web-download-toolkit-holed-by-authentication-bug/
exploit-db	www.exploit-db.com/exploits/24487

Parameter	Position	Path	Description	CWE
realm	header	evilserver.com/	Stack-based buffer overflow in libcurl during SASL DIGEST-MD5 negotiation triggered by a long realm value in a server challenge; attack via HTTP redirect to a POP3/IMAP/SMTP service.	CWE-119
realm	header	pop3://x:[email protected]/.	Same vulnerability exploited via POP3 SASL DIGEST-MD5 handshake after HTTP redirect; realm parameter causes overflow.	CWE-119

16 Jun 2026 23:49Current

8High risk

Vulners AI Score8

CVSS 27.5

EPSS0.21643