CVE-2018-14618: Buffer Overflow
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curlntlmcoremknthash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit sizet, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)
Other sources
NTLM password overflow via integer overflow ===========================================
Project curl Security Advisory, September 5th 2018 - Permalink
VULNERABILITY -------------
libcurl contains a buffer overflow in the NTLM authentication code.
The internal function Curlntlmcoremknthash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap.
The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit sizet, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow.
(This bug is almost identical to CVE-2017-8816.)
We are not aware of any exploit of this flaw.
INFO ----
This bug was introduced in commit be285cde3f, April 2006.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2018-XXXX to this issue.
CWE-131: Incorrect Calculation of Buffer Size
AFFECTED VERSIONS -----------------
This is only an issue on 32 bit systems. It also requires the password field to use more than 2GB of memory, which in itself should be rare.
- Affected versions: libcurl 7.15.4 to and including 7.61.0 - Not affected versions: libcurl < 7.15.4 and >= 7.61.1
curl is used by many applications, but not always advertised as such.
THE SOLUTION ------------
In libcurl version 7.61.1, the integer overflow is avoided.
A patch for CVE-2018-XXXX is available.
RECOMMENDATIONS ---------------
We suggest you take one of the following actions immediately, in order of preference:
A - Upgrade curl to version 7.61.1
B - Apply the patch to your version and rebuild
C - Put length restrictions on the password you can pass to libcurl
TIME LINE ---------
It was publicly reported to the curl project on July 18, 2018. We contacted distros@openwall on August 27.
curl 7.61.1 was released on September 5 2018, coordinated with the publication of this advisory.
CREDITS -------
Reported by Zhaoyang Wu. Patch by Daniel Stenberg.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 0:7.29.0-51.el7_6.3 - Upgrade
Upgrade
redhat/httpd24-curlto a version that resolves this vulnerability.Fixed in 0:7.61.1-1.el6 - Upgrade
Upgrade
redhat/httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.34-7.el6 - Upgrade
Upgrade
redhat/httpd24-nghttp2to a version that resolves this vulnerability.Fixed in 0:1.7.1-7.el6 - Upgrade
Upgrade
redhat/httpd24-curlto a version that resolves this vulnerability.Fixed in 0:7.61.1-1.el7 - Upgrade
Upgrade
redhat/httpd24-httpdto a version that resolves this vulnerability.Fixed in 0:2.4.34-7.el7 - Upgrade
Upgrade
redhat/httpd24-nghttp2to a version that resolves this vulnerability.Fixed in 0:1.7.1-7.el7 - Upgrade
Upgrade
debian/curlto a version that resolves this vulnerability.Fixed in 7.74.0-1.3+deb11u13Fixed in 7.74.0-1.3+deb11u16Fixed in 7.88.1-10+deb12u14Fixed in 7.88.1-10+deb12u5Fixed in 8.14.1-2+deb13u2Fixed in 8.19.0-3Fixed in 8.20.0~rc2-1 - Upgrade
Upgrade
redhat/curlto a version that resolves this vulnerability.Fixed in 7.61.1 - Upgrade
Upgrade
libcurlto a version that resolves this vulnerability.Fixed in 7.61.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2018-bf5f - Configuration
Put length restrictions on the password you can pass to libcurl (this issue occurs when the password length exceeds 2GB / 2^31 bytes on 32-bit systems).
libcurl (NTLM authentication) password length restriction = <= 2GB (2^31 bytes)
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2018-14618?
CVE-2018-14618 is a vulnerability in the NTLM authentication code of curl before version 7.61.1.
What is the severity of CVE-2018-14618?
CVE-2018-14618 has a severity value of 9.8, which is classified as critical.
How does CVE-2018-14618 affect curl?
CVE-2018-14618 affects curl versions before 7.61.1, and it is specifically related to a buffer overrun in the NTLM authentication code.
How can I fix CVE-2018-14618?
To fix CVE-2018-14618, you need to update curl to version 7.61.1 or later.
Where can I find more information about CVE-2018-14618?
You can find more information about CVE-2018-14618 on the official curl website and the Red Hat security page.