漏洞标题
N/A
漏洞描述信息
在执行FTP时，libcurl可能在堆内存分配缓冲区外读取。当libcurl连接到FTP服务器并成功登录(匿名或不)，它使用`PWD`命令向服务器询问当前目录。服务器随后返回一个包含路径的257响应，内嵌双引号。返回的路径名称随后被libcurl保留，用于后续的使用。由于此目录名称字符串解析器的一个缺陷，一个包含而没有关闭双引号的文件名将会导致libcurl未将结尾的null字节添加到保存名称的缓冲区中。当libcurl后来访问字符串时，它可以读取到分配的堆内存缓冲区之外，并崩溃或错误地访问缓冲区之外的数据，认为它是路径的一部分。恶意服务器可以利用这一事实，有效地防止基于libcurl的客户端与其工作 - PWD命令总是在新的FTP连接上 issued，而错误有很高的概率导致Segmentation Fault。这一事实表明，这种错误的未处理字符串可能导致安全服务器中这种情况的罕见。我们并不知道有关这个漏洞的任何利用。此漏洞是在2005年3月发布的[415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7)。在libcurl版本7.56.0中，解析器总是以0结束字符串，但如果在结尾处没有正确结束双引号，则拒绝接受。
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit [415d2e7cb7](https://github.com/curl/curl/commit/415d2e7cb7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Haxx libcurl 安全漏洞
漏洞描述信息
Haxx libcurl是瑞典Haxx公司的一个免费、开源的客户端URL传输库。该库支持FTP、FTPS、TFTP、HTTP等。 Haxx libcurl 7.7版本至7.55.1版本中存在安全漏洞。攻击者可利用该漏洞造成拒绝服务。
CVSS信息
N/A
漏洞类别
缓冲区错误