cURL Buffer Overflow Vulnerability

Last Update Date: 14 Feb 2013 17:42 Release Date: 14 Feb 2013 3990 Views

RISK: High Risk

TYPE: Clients - Productivity Products

A vulnerability has been identified in cURL. A remote user can execute arbitrary code on the target system.

A remote server can return specially crafted data via POP3, SMTP, or IMAP to trigger a buffer overflow in Curl_sasl_create_digest_md5_message() and execute arbitrary code on the target system.

Impact

Remote Code Execution
LAN Based Remote Code Execution

System / Technologies affected

cURL version 7.26.0 - 7.28.1

Solutions

Before installation of the software, please visit the software manufacturer web-site for more details.

The vendor has issued a fix (7.29.0).
http://curl.haxx.se/docs/adv_20130206.html

Vulnerability Identifier

CVE-2013-0249

Source

SecurityTracker