Buffer over-read in curl (Alpine package)



Published: 2017-10-24
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2017-1000257
CWE-ID CWE-126
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		curl (Alpine package)
Operating systems & Components / Operating system package or component

Vendor Alpine Linux Development Team

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Buffer over-read

EUVDB-ID: #VU8917

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-1000257

CWE-ID: CWE-126 - Buffer over-read

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information or cause DoS condition on the target system.

The weakness exists due to buffer overread in the IMAP handle. A remote attacker can return a specially crafted IMAP FETCH response, obtain potentially sensitive information from memory on the target system or cause the target application using libcurl to crash.

Mitigation

Install update from vendor's website.

Vulnerable software versions

curl (Alpine package): 7.55.0-r1

CPE2.3 External links

http://git.alpinelinux.org/aports/commit/?id=cbf50badfab16636b8752fadd5fa558b9fca6999
http://git.alpinelinux.org/aports/commit/?id=ce9547d7658833fa03e38422973b5dc864564890
http://git.alpinelinux.org/aports/commit/?id=32fded0210af14baa402d6ba73f8dcce05594a9e
http://git.alpinelinux.org/aports/commit/?id=19db43b33cef01ef48f97b2f0a7692c1998f2910
http://git.alpinelinux.org/aports/commit/?id=fa79414275b8e476541b4431ae166a02512b2420


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###