CVE-2013-0249: Buffer Overflow

Published Mar 8, 2013

Updated

Stack-based buffer overflow in the Curlsaslcreatedigestmd5message function in lib/curlsasl.c in curl and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message.

Affected Software

9 affected components

haxx curl=7.26.0

haxx curl=7.27.0

haxx curl=7.28.0

haxx curl=7.28.1

haxx libcurl=7.26.0

haxx libcurl=7.27.0

haxx libcurl=7.28.0

haxx libcurl=7.28.1

Canonical Ubuntu Linux=12.10

Event History

Mar 8, 2013

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-0249?

CVE-2013-0249 is rated as high severity due to its potential to lead to a denial of service and arbitrary code execution.

How do I fix CVE-2013-0249?

To fix CVE-2013-0249, upgrade Curl or libcurl to versions 7.29.0 or later.

What versions of Curl are affected by CVE-2013-0249?

Curl versions 7.26.0 to 7.28.1 are affected by CVE-2013-0249.

Can CVE-2013-0249 be exploited remotely?

Yes, CVE-2013-0249 can be exploited remotely through crafted SASL DIGEST-MD5 authentication messages.

What impact does CVE-2013-0249 have on affected systems?

CVE-2013-0249 can cause a denial of service, potentially leading to crashes or the execution of arbitrary code on affected systems.