Vulnerability Description
An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer and the size (zero) to the deliver-data function. libcurl's deliver-data function treats zero as a magic number and invokes strlen() on the data to figure out the length. The strlen() is called on a heap based buffer that might not be zero terminated so libcurl might read beyond the end of it into whatever memory lies after (or just crash) and then deliver that to the application as if it was actually downloaded.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Libcurl | >= 7.20.0, <= 7.56.0 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://www.debian.org/security/2017/dsa-4007Third Party Advisory
- http://www.securityfocus.com/bid/101519Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039644Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:3263
- https://access.redhat.com/errata/RHSA-2018:2486
- https://access.redhat.com/errata/RHSA-2018:3558
- https://curl.haxx.se/docs/adv_20171023.htmlVendor Advisory
- https://security.gentoo.org/glsa/201712-04
- http://www.debian.org/security/2017/dsa-4007Third Party Advisory
- http://www.securityfocus.com/bid/101519Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1039644Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:3263
- https://access.redhat.com/errata/RHSA-2018:2486
- https://access.redhat.com/errata/RHSA-2018:3558
- https://curl.haxx.se/docs/adv_20171023.htmlVendor Advisory
FAQ
What is CVE-2017-1000257?
CVE-2017-1000257 is a vulnerability with a CVSS score of 9.1 (CRITICAL). An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on that (non-existing) data with a pointer a...
How severe is CVE-2017-1000257?
CVE-2017-1000257 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-1000257?
Check the references section above for vendor advisories and patch information. Affected products include: Haxx Libcurl, Debian Debian Linux.