CVE-2018-1000120: Buffer Overflow

Published Mar 7, 2018
·
Updated

A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse.

Other sources

It was found that curl can be fooled into writing a zero byte out of bounds.

This bug can trigger when curl is told to work on an FTP URL, with the setting to only issue a single CWD command (--ftp-method singlecwd or the libcurl alternative CURLOPTFTPFILEMETHOD).

curl then URL-decodes the given path, calls strlen() on the result and deducts the length of the file name part to find the end of the directory within the buffer. It then writes a zero byte on that index, in a buffer allocated on the heap.

If the directory part of the URL contains a "%00" sequence, the directory length might end up shorter than the file name path, making the calculation sizet index = directorylen - filepartlen end up with a huge index variable for where the zero byte gets stored: heapbuffer[index] = 0. On several architectures that huge index will wrap and work as a negative value, thus overwriting memory before the intended heap buffer.

By using different file part lengths and putting %00 in different places in the URL, an attacker that can control what paths a curl-using application uses can write that zero byte on different indexes.

— Red Hat

It was found that libcurl did not safely parse FTP URLs when using the CURLOPTFTPFILEMETHOD method. An attacker, able to provide a specially crafted FTP URL to an application using libcurl, could write a NULL byte at an arbitrary location, resulting in a crash or an unspecified behavior.

Affected Software

29 affected componentsFixes available
redhat/curl<0:7.29.0-51.el7
0:7.29.0-51.el7
redhat/nss-pem<0:1.0.3-5.el7
0:1.0.3-5.el7
redhat/curl<0:7.29.0-42.el7_4.2
0:7.29.0-42.el7_4.2
redhat/curl<0:7.29.0-46.el7_5.1
0:7.29.0-46.el7_5.1
redhat/httpd24-curl<0:7.61.1-1.el6
0:7.61.1-1.el6
redhat/httpd24-httpd<0:2.4.34-7.el6
0:2.4.34-7.el6
redhat/httpd24-nghttp2<0:1.7.1-7.el6
0:1.7.1-7.el6
redhat/httpd24-curl<0:7.61.1-1.el7
0:7.61.1-1.el7
redhat/httpd24-httpd<0:2.4.34-7.el7
0:2.4.34-7.el7
redhat/httpd24-nghttp2<0:1.7.1-7.el7
0:1.7.1-7.el7
redhat/curl<7.59.0
7.59.0
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Canonical Ubuntu Linux=12.04
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=17.10
haxx curl>=7.12.3<=7.58.0
redhat Enterprise Linux Desktop=7.0
redhat Enterprise Linux Server=7.0
redhat Enterprise Linux Workstation=7.0
Oracle Communications WebRTC Session Controller<7.2
Oracle Enterprise Manager Ops Center=12.2.2
Oracle Enterprise Manager Ops Center=12.3.3
Oracle PeopleSoft Enterprise PeopleTools=8.55
Oracle PeopleSoft Enterprise PeopleTools=8.56
Oracle PeopleSoft Enterprise PeopleTools=8.57
debian/curl
7.74.0-1.3+deb11u137.74.0-1.3+deb11u167.88.1-10+deb12u147.88.1-10+deb12u58.14.1-2+deb13u38.20.0-58.21.0~rc2-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/curl to a version that resolves this vulnerability.

    Fixed in 0:7.29.0-51.el7
  2. Upgrade

    Upgrade redhat/nss-pem to a version that resolves this vulnerability.

    Fixed in 0:1.0.3-5.el7
  3. Upgrade

    Upgrade redhat/curl to a version that resolves this vulnerability.

    Fixed in 0:7.29.0-42.el7_4.2
  4. Upgrade

    Upgrade redhat/curl to a version that resolves this vulnerability.

    Fixed in 0:7.29.0-46.el7_5.1
  5. Upgrade

    Upgrade redhat/httpd24-curl to a version that resolves this vulnerability.

    Fixed in 0:7.61.1-1.el6
  6. Upgrade

    Upgrade redhat/httpd24-httpd to a version that resolves this vulnerability.

    Fixed in 0:2.4.34-7.el6
  7. Upgrade

    Upgrade redhat/httpd24-nghttp2 to a version that resolves this vulnerability.

    Fixed in 0:1.7.1-7.el6
  8. Upgrade

    Upgrade redhat/httpd24-curl to a version that resolves this vulnerability.

    Fixed in 0:7.61.1-1.el7
  9. Upgrade

    Upgrade redhat/httpd24-httpd to a version that resolves this vulnerability.

    Fixed in 0:2.4.34-7.el7
  10. Upgrade

    Upgrade redhat/httpd24-nghttp2 to a version that resolves this vulnerability.

    Fixed in 0:1.7.1-7.el7
  11. Upgrade

    Upgrade redhat/curl to a version that resolves this vulnerability.

    Fixed in 7.59.0
  12. Upgrade

    Upgrade debian/curl to a version that resolves this vulnerability.

    Fixed in 7.74.0-1.3+deb11u13Fixed in 7.74.0-1.3+deb11u16Fixed in 7.88.1-10+deb12u14Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u3Fixed in 8.20.0-5Fixed in 8.21.0~rc2-1
  13. Upgrade

    Upgrade debian/curl to a version that resolves this vulnerability.

    Fixed in 7.74.0-1.3+deb11u13
  14. Upgrade

    Upgrade debian/curl to a version that resolves this vulnerability.

    Fixed in 7.74.0-1.3+deb11u16
  15. Upgrade

    Upgrade debian/curl to a version that resolves this vulnerability.

    Fixed in 7.88.1-10+deb12u14
  16. Upgrade

    Upgrade debian/curl to a version that resolves this vulnerability.

    Fixed in 7.88.1-10+deb12u5
  17. Upgrade

    Upgrade debian/curl to a version that resolves this vulnerability.

    Fixed in 8.14.1-2+deb13u3
  18. Upgrade

    Upgrade debian/curl to a version that resolves this vulnerability.

    Fixed in 8.20.0-5
  19. Upgrade

    Upgrade debian/curl to a version that resolves this vulnerability.

    Fixed in 8.21.0~rc2-1
  20. Configuration

    Ensure applications do not set CURLOPT_FTP_FILEMETHOD to a non-default value; keep the FTP file method at the library default to avoid invoking the vulnerable FTP URL parsing code.

    libcurl CURLOPT_FTP_FILEMETHOD = do not use non-default
  21. Configuration

    Avoid using the --ftp-method singlecwd (or other non-default ftp-methods) on the curl command line; use the default FTP method so the vulnerable code path is not triggered.

    curl (CLI) --ftp-method = do not use 'singlecwd' or other non-defaults

Event History

Mar 14, 2018
CVE Published
12:00 AM
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Data Sourced
via NVD·06:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:43 PM
Description
Feb 20, 2026
Data Sourced
via Ubuntu·03:20 PM
RemedyDescriptionSeverityAffected Software
Jun 14, 2026
Data Sourced
via Debian·10:33 PM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the vulnerability ID?

The vulnerability ID is CVE-2018-1000120.

2

What is the severity of CVE-2018-1000120?

The severity of CVE-2018-1000120 is critical.

3

What is the affected software for CVE-2018-1000120?

The affected software for CVE-2018-1000120 includes curl versions 7.12.3 to 7.58.0 and certain versions of debian, Ubuntu, Redhat, and Oracle products.

4

How can an attacker exploit CVE-2018-1000120?

An attacker can exploit CVE-2018-1000120 by providing a specially crafted FTP URL to an application using libcurl, which can result in a crash or unspecified behavior.

5

Are there any available fixes for CVE-2018-1000120?

Yes, the recommended fix for CVE-2018-1000120 is to upgrade to curl version 7.59.0 or higher.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203