Browse code
curl: Fix for CVE-2019-3823
curl is vulnerable for out of band reads in end of SMTP responses, if the buffer passed to smtp_endofresp() is not NULL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol() call reads beyond the allocated buffer. The read contents will not be returned to the caller.
Change-Id: Ibfc3ad9f2f163ea711c3593673f2de7a8bf30a60
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6712
Tested-by: gerrit-photon <photon-checkins@vmware.com>
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
dweepadvani authored on 2019/02/15 00:08:38Showing 2 changed files
| 1 | 1 |
new file mode 100644 |
| ... | ... |
@@ -0,0 +1,44 @@ |
| 0 |
+From 39df4073e5413fcdbb5a38da0c1ce6f1c0ceb484 Mon Sep 17 00:00:00 2001 |
|
| 1 |
+From: Daniel Gustafsson <daniel@yesql.se> |
|
| 2 |
+Date: Sat, 19 Jan 2019 00:42:47 +0100 |
|
| 3 |
+Subject: [PATCH] smtp: avoid risk of buffer overflow in strtol |
|
| 4 |
+ |
|
| 5 |
+If the incoming len 5, but the buffer does not have a termination |
|
| 6 |
+after 5 bytes, the strtol() call may keep reading through the line |
|
| 7 |
+buffer until is exceeds its boundary. Fix by ensuring that we are |
|
| 8 |
+using a bounded read with a temporary buffer on the stack. |
|
| 9 |
+ |
|
| 10 |
+Bug: https://curl.haxx.se/docs/CVE-2019-3823.html |
|
| 11 |
+Reported-by: Brian Carpenter (Geeknik Labs) |
|
| 12 |
+CVE-2019-3823 |
|
| 13 |
+--- |
|
| 14 |
+ lib/smtp.c | 8 ++++++-- |
|
| 15 |
+ 1 file changed, 6 insertions(+), 2 deletions(-) |
|
| 16 |
+ |
|
| 17 |
+diff --git a/lib/smtp.c b/lib/smtp.c |
|
| 18 |
+index 84fc68e418..d55647b12e 100644 |
|
| 19 |
+--- a/lib/smtp.c |
|
| 20 |
+@@ -5,7 +5,7 @@ |
|
| 21 |
+ * | (__| |_| | _ <| |___ |
|
| 22 |
+ * \___|\___/|_| \_\_____| |
|
| 23 |
+ * |
|
| 24 |
+- * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al. |
|
| 25 |
++ * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al. |
|
| 26 |
+ * |
|
| 27 |
+ * This software is licensed as described in the file COPYING, which |
|
| 28 |
+ * you should have received as part of this distribution. The terms |
|
| 29 |
+@@ -207,8 +207,12 @@ static bool smtp_endofresp(struct connectdata *conn, char *line, size_t len, |
|
| 30 |
+ Section 4. Examples of RFC-4954 but some e-mail servers ignore this and |
|
| 31 |
+ only send the response code instead as per Section 4.2. */ |
|
| 32 |
+ if(line[3] == ' ' || len == 5) {
|
|
| 33 |
++ char tmpline[6]; |
|
| 34 |
++ |
|
| 35 |
+ result = TRUE; |
|
| 36 |
+- *resp = curlx_sltosi(strtol(line, NULL, 10)); |
|
| 37 |
++ memset(tmpline, '\0', sizeof(tmpline)); |
|
| 38 |
++ memcpy(tmpline, line, (len == 5 ? 5 : 3)); |
|
| 39 |
++ *resp = curlx_sltosi(strtol(tmpline, NULL, 10)); |
|
| 40 |
+ |
|
| 41 |
+ /* Make sure real server never sends internal value */ |
|
| 42 |
+ if(*resp == 1) |
| ... | ... |
@@ -1,7 +1,7 @@ |
| 1 | 1 |
Summary: An URL retrieval utility and library |
| 2 | 2 |
Name: curl |
| 3 | 3 |
Version: 7.59.0 |
| 4 |
-Release: 4%{?dist}
|
|
| 4 |
+Release: 5%{?dist}
|
|
| 5 | 5 |
License: MIT |
| 6 | 6 |
URL: http://curl.haxx.se |
| 7 | 7 |
Group: System Environment/NetworkingLibraries |
| ... | ... |
@@ -16,6 +16,7 @@ Patch3: curl-CVE-2018-16839.patch |
| 16 | 16 |
Patch4: curl-CVE-2018-16840.patch |
| 17 | 17 |
Patch5: curl-CVE-2018-16842.patch |
| 18 | 18 |
Patch6: curl-CVE-2018-14618.patch |
| 19 |
+Patch7: curl-CVE-2019-3823.patch |
|
| 19 | 20 |
BuildRequires: ca-certificates |
| 20 | 21 |
BuildRequires: openssl-devel |
| 21 | 22 |
BuildRequires: krb5-devel |
| ... | ... |
@@ -55,6 +56,7 @@ This package contains minimal set of shared curl libraries. |
| 55 | 55 |
%patch4 -p1 |
| 56 | 56 |
%patch5 -p1 |
| 57 | 57 |
%patch6 -p1 |
| 58 |
+%patch7 -p1 |
|
| 58 | 59 |
|
| 59 | 60 |
%build |
| 60 | 61 |
./configure \ |
| ... | ... |
@@ -107,6 +109,8 @@ rm -rf %{buildroot}/*
|
| 107 | 107 |
%{_libdir}/libcurl.so.*
|
| 108 | 108 |
|
| 109 | 109 |
%changelog |
| 110 |
+* Thu Feb 14 2019 Dweep Advani <dadvani@vmware.com> 7.59.0-5 |
|
| 111 |
+- Fix for CVE-2019-3823 |
|
| 110 | 112 |
* Tue Jan 29 2019 Dweep Advani <dadvani@vmware.com> 7.59.0-4 |
| 111 | 113 |
- Fix for CVE-2018-16839, CVE-2018-16840, CVE-2018-16842 and CVE-2018-14618 |
| 112 | 114 |
* Tue Sep 18 2018 Keerthana K <keerthanak@vmware.com> 7.59.0-3 |