libcURL up to 7.30.0 on WinCE lib/vtls/schannel.c verify_certificate Certificate out-of-bounds

Summaryinfo

A vulnerability was found in libcURL up to 7.30.0 on WinCE. It has been declared as critical. This affects the function verify_certificate in the library lib/vtls/schannel.c. Such manipulation as part of Certificate leads to out-of-bounds. This vulnerability is documented as CVE-2016-9953. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in libcURL up to 7.30.0 on WinCE (Network Utility Software) and classified as critical. Affected by this issue is the function verify_certificate in the library lib/vtls/schannel.c. The manipulation as part of a Certificate leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.

The bug was discovered 11/29/2016. The weakness was released 03/12/2018 (Website). The advisory is available at curl.haxx.se. This vulnerability is handled as CVE-2016-9953 since 12/15/2016. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit.

The vulnerability was handled as a non-public zero-day exploit for at least 468 days. During that time the estimated underground price was around $0-$5k. The commercial vulnerability scanner Qualys is able to test this issue with plugin 43619 (Juniper Junos OS Multiple vulnerabilities in cURL versions (JSA10874)).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entry connected to this vulnerability is available at VDB-114385. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Network Utility Software

Name

• libcURL

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8
• 7.9
• 7.10
• 7.11
• 7.12
• 7.13
• 7.14
• 7.15
• 7.16
• 7.17
• 7.18
• 7.19
• 7.20
• 7.21
• 7.22
• 7.23
• 7.24
• 7.25
• 7.26
• 7.27
• 7.28
• 7.29
• 7.30.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion