cURL up to 7.46.x on Windows filename input validation

Summaryinfo

A vulnerability identified as critical has been detected in cURL up to 7.46.x on Windows. This issue affects some unknown processing. Performing a manipulation of the argument filename with the input [string1];[string2] results in input validation. This vulnerability was named CVE-2016-0754. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in cURL up to 7.46.x on Windows (Network Utility Software). This affects some unknown functionality. The manipulation of the argument filename with the input value [string1];[string2] leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

cURL before 7.47.0 on Windows allows attackers to write to arbitrary files in the current working directory on a different drive via a colon in a remote file name.

The weakness was presented 01/29/2016 (Website). The advisory is shared at curl.haxx.se. This vulnerability is uniquely identified as CVE-2016-0754 since 12/16/2015. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

The commercial vulnerability scanner Qualys is able to test this issue with plugin 43619 (Juniper Junos OS Multiple vulnerabilities in cURL versions (JSA10874)).

Upgrading to version 7.47.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityFocus (BID 92309†). See VDB-8439, VDB-9262, VDB-10906 and VDB-11245 for similar entries. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Network Utility Software

Name

• cURL

Version

• 7.0
• 7.1
• 7.2
• 7.3
• 7.4
• 7.5
• 7.6
• 7.7
• 7.8
• 7.9
• 7.10
• 7.11
• 7.12
• 7.13
• 7.14
• 7.15
• 7.16
• 7.17
• 7.18
• 7.19
• 7.20
• 7.21
• 7.22
• 7.23
• 7.24
• 7.25
• 7.26
• 7.27
• 7.28
• 7.29
• 7.30
• 7.31
• 7.32
• 7.33
• 7.34
• 7.35
• 7.36
• 7.37
• 7.38
• 7.39
• 7.40
• 7.41
• 7.42
• 7.43
• 7.44
• 7.45
• 7.46

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion