CVE-2013-7038: Buffer Overflow
An out-of-bounds memory read flaw was found in the MHDhttpunescape() function in libmicrohttpd. This could possibly lead to information disclosure or allow a remote attacker to cause an application using libmicrohttpd to crash. This issue has been resolved in version 0.9.32.
References: https://gnunet.org/svn/libmicrohttpd/ChangeLog http://secunia.com/advisories/55903/ https://bugs.gentoo.org/showbug.cgi?id=493450
Acknowledgements:
This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
Other sources
The MHDhttpunescape function in libmicrohttpd before 0.9.32 might allow remote attackers to obtain sensitive information or cause a denial of service (crash) via unspecified vectors that trigger an out-of-bounds read.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libmicrohttpdto a version that resolves this vulnerability.Fixed in 0.9.32
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7038?
The severity of CVE-2013-7038 is considered to be medium due to the potential for information disclosure and application crashes.
How do I fix CVE-2013-7038?
To fix CVE-2013-7038, upgrade to libmicrohttpd version 0.9.32 or later.
What versions of libmicrohttpd are affected by CVE-2013-7038?
CVE-2013-7038 affects libmicrohttpd versions up to and including 0.9.31.
Can CVE-2013-7038 be exploited remotely?
Yes, CVE-2013-7038 can potentially be exploited remotely, allowing an attacker to cause a crash in applications using libmicrohttpd.
What is the nature of the vulnerability in CVE-2013-7038?
CVE-2013-7038 is an out-of-bounds memory read flaw in the MHD_http_unescape() function.