K85235351 : cURL and libcurl vulnerability CVE-2016-8624

Security Advisory Description

curl before version 7.51.0 doesn’t parse the authority component of the URL correctly when the host name part ends with a ‘#’ character, and could instead be tricked into connecting to a different host. This may have security implications if you for example use an URL parser that follows the RFC to check for allowed domains before using curl to request them. (CVE-2016-8624)

Impact

When a domain name ends with a number sign (#), cURL does not parse the authority component of the URL correctly and can be tricked into connecting to a different host. For example:

<http://f5.com#@example.com/x.txt&gt;

To exploit this vulnerability, cURL must parse a malformed URL. The BIG-IP system uses cURL/libcurl for IMAP, FTP, POP3, SMTP, Windows WMI, RealServer, and custom external monitors that incorporate cURL. On the BIG-IP system, access to the cURL utility is restricted to locally authenticated users.