CVE-2017-1000257 Information disclosure in n/a
libcurl may read beyond heap buffer boundaries when processing zero-length IMAP FETCH responses, potentially leaking memory or causing crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-1000257?
CVE-2017-1000257 is a critical vulnerability in Debian Debian Linux, published on 31 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
Weakness: CWE-119
Which versions are affected by CVE-2017-1000257?
It affects 2 products.
Linux distribution packages (16)
curl Red Hat:enterprise_linux:7::client | All versions | 0:7.29.0-42.el7_4.1 |
curl-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:7.29.0-42.el7_4.1 |
libcurl Red Hat:enterprise_linux:7::client | All versions | 0:7.29.0-42.el7_4.1 |
libcurl-devel Red Hat:enterprise_linux:7::client | All versions | 0:7.29.0-42.el7_4.1 |
curl Red Hat:enterprise_linux:7::computenode | All versions | 0:7.29.0-42.el7_4.1 |
curl-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:7.29.0-42.el7_4.1 |
libcurl Red Hat:enterprise_linux:7::computenode | All versions | 0:7.29.0-42.el7_4.1 |
libcurl-devel Red Hat:enterprise_linux:7::computenode | All versions | 0:7.29.0-42.el7_4.1 |
curl Red Hat:enterprise_linux:7::server | All versions | 0:7.29.0-42.el7_4.1 |
curl-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:7.29.0-42.el7_4.1 |
libcurl Red Hat:enterprise_linux:7::server | All versions | 0:7.29.0-42.el7_4.1 |
libcurl-devel Red Hat:enterprise_linux:7::server | All versions | 0:7.29.0-42.el7_4.1 |
curl Red Hat:enterprise_linux:7::workstation | All versions | 0:7.29.0-42.el7_4.1 |
curl-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:7.29.0-42.el7_4.1 |
libcurl Red Hat:enterprise_linux:7::workstation | All versions | 0:7.29.0-42.el7_4.1 |
libcurl-devel Red Hat:enterprise_linux:7::workstation | All versions | 0:7.29.0-42.el7_4.1 |
Products include Debian Debian Linux, Haxx Libcurl.
How do I fix CVE-2017-1000257?
Upgrade to a fixed version.
Is CVE-2017-1000257 being exploited?
There is no known exploitation of CVE-2017-1000257 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2017-1000257, CLEANSTART-2026-IY06561, CURL-CVE-2017-1000257, DEBIAN-CVE-2017-1000257, DLA-1143-1, DSA-4007-1 and 4 more.