--nextPart1180827.hqSRaWdueC

Content-Type: text/plain;

  charset="us-ascii"

Content-Transfer-Encoding: 7bit

Content-Disposition: inline



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Gentoo Linux Security Advisory                           GLSA 200512-09

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

                                            http://security.gentoo.org/

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



  Severity: Low

     Title: cURL: Off-by-one errors in URL handling

      Date: December 16, 2005

      Bugs: #114710

        ID: 200512-09



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Synopsis

========



cURL is vulnerable to local arbitrary code execution via buffer

overflow due to the insecure parsing of URLs.



Background

==========



cURL is a command line tool for transferring files with URL syntax,

supporting numerous protocols.



Affected packages

=================



    -------------------------------------------------------------------

     Package        /  Vulnerable  /                        Unaffected

    -------------------------------------------------------------------

  1  net-misc/curl      < 7.15.1                             >= 7.15.1



Description

===========



Stefan Esser from the Hardened-PHP Project has reported a vulnerability

in cURL that allows for a local buffer overflow when cURL attempts to

parse specially crafted URLs. The URL can be specially crafted in one

of two ways: the URL could be malformed in a way that prevents a

terminating null byte from being added to either a hostname or path

buffer; or the URL could contain a "?" separator in the hostname

portion, which causes a "/" to be prepended to the resulting string.



Impact

======



An attacker capable of getting cURL to parse a maliciously crafted URL

could cause a denial of service or execute arbitrary code with the

privileges of the user making the call to cURL. An attacker could also

escape open_basedir or safe_mode pseudo-restrictions when exploiting

this problem from within a PHP program when PHP is compiled with

libcurl.



Workaround

==========



There is no known workaround at this time.



Resolution

==========



All cURL users should upgrade to the latest version:



    # emerge --sync

    # emerge --ask --oneshot --verbose ">=net-misc/curl-7.15.1"



References

==========



  [ 1 ] CVE-2005-4077

        http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4077

  [ 2 ] Hardened-PHP Advisory

        http://www.hardened-php.net/advisory_242005.109.html



Availability

============



This GLSA and any updates to it are available for viewing at

the Gentoo Security Website:



  http://security.gentoo.org/glsa/glsa-200512-09.xml



Concerns?

=========



Security is a primary focus of Gentoo Linux and ensuring the

confidentiality and security of our users machines is of utmost

importance to us. Any security concerns should be addressed to

security@gentoo.org or alternatively, you may file a bug at

http://bugs.gentoo.org.



License

=======



Copyright 2005 Gentoo Foundation, Inc; referenced text

belongs to its owner(s).



The contents of this document are licensed under the

Creative Commons - Attribution / Share Alike license.



http://creativecommons.org/licenses/by-sa/2.0



--nextPart1180827.hqSRaWdueC

Content-Type: application/pgp-signature



-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.2 (GNU/Linux)



iD8DBQBDovIGzKC5hMHO6rkRAjPHAJ93osrJMpu5Dq3fCNC7/L95stZvMwCfc9dP

VBJT4Dq9nZtjWyf8i6pcDFY=

=SByB

-----END PGP SIGNATURE-----



--nextPart1180827.hqSRaWdueC--

-- 

gentoo-announce@gentoo.org mailing list