CVE-2019-3822
curl: NTLMv2 type-3 header stack buffer overflow
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.
Libcurl, desde la versión 7.36.0 hasta antes de la 7.64.0, es vulnerable a un desbordamiento de búfer basado en pila. La función que crea una cabecera saliente NTLM de tipo 3 ("lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()") genera el contenido de la cabecera de petición HTTP basándose en datos recibidos anteriormente. La comprobación para evitar que el búfer local se desborde está mal implementada (utilizando matemática no firmada) y, así, no evita que el desbordamiento ocurra. Estos datos de salida pueden aumentar más que el búfer local si se extraen datos "nt response" muy grandes de una cabecera NTLMv2 previa, proporcionada por el servidor HTTP malicioso o roto. Este "valor grande" necesita ser de, aproximadamente, 1000 bytes o más. Los datos reales de la carga útil que se copian al búfer objetivo provienen de la cabecera de respuesta NTLMv2 de tipo 2.
A stack-based buffer overflow was found in the way curl handled NTLMv2 type-3 headers. When connecting to a remote malicious server which uses NTLM authentication, the flaw could cause curl to crash.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-01-03 CVE Reserved
- 2019-02-06 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2024-08-08 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-121: Stack-based Buffer Overflow
- CWE-787: Out-of-bounds Write
CAPEC
References (17)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/106950 | Third Party Advisory | |
| https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf | Third Party Advisory |
|
| https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89f1146f%40%3Cdevnull.infra.apache.org%3E | Mailing List | |
| https://security.netapp.com/advisory/ntap-20190719-0004 | Third Party Advisory |
|
| https://support.f5.com/csp/article/K84141449 | Third Party Advisory | |
| https://support.f5.com/csp/article/K84141449?utm_source=f5support&%3Butm_medium=RSS | X_refsource_confirm |
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822 | 2024-08-04 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2019:3701 | 2023-11-07 | |
| https://security.gentoo.org/glsa/201903-03 | 2023-11-07 | |
| https://usn.ubuntu.com/3882-1 | 2023-11-07 | |
| https://www.debian.org/security/2019/dsa-4386 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2019-3822 | 2019-11-05 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1670254 | 2019-11-05 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Haxx Search vendor "Haxx" | Libcurl Search vendor "Haxx" for product "Libcurl" | >= 7.36.0 < 7.64.0 Search vendor "Haxx" for product "Libcurl" and version " >= 7.36.0 < 7.64.0" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 16.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "16.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 18.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "18.10" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | >= 7.3 Search vendor "Netapp" for product "Active Iq Unified Manager" and version " >= 7.3" | windows |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | >= 9.5 Search vendor "Netapp" for product "Active Iq Unified Manager" and version " >= 9.5" | vsphere |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Clustered Data Ontap Search vendor "Netapp" for product "Clustered Data Ontap" | * | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Oncommand Insight Search vendor "Netapp" for product "Oncommand Insight" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Oncommand Workflow Automation Search vendor "Netapp" for product "Oncommand Workflow Automation" | - | - |
Affected
| ||||||
| Netapp Search vendor "Netapp" | Snapcenter Search vendor "Netapp" for product "Snapcenter" | - | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Sinema Remote Connect Client Search vendor "Siemens" for product "Sinema Remote Connect Client" | <= 2.0 Search vendor "Siemens" for product "Sinema Remote Connect Client" and version " <= 2.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Operations Monitor Search vendor "Oracle" for product "Communications Operations Monitor" | 3.4 Search vendor "Oracle" for product "Communications Operations Monitor" and version "3.4" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Communications Operations Monitor Search vendor "Oracle" for product "Communications Operations Monitor" | 4.0 Search vendor "Oracle" for product "Communications Operations Monitor" and version "4.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Enterprise Manager Ops Center Search vendor "Oracle" for product "Enterprise Manager Ops Center" | 12.3.3 Search vendor "Oracle" for product "Enterprise Manager Ops Center" and version "12.3.3" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Enterprise Manager Ops Center Search vendor "Oracle" for product "Enterprise Manager Ops Center" | 12.4.0 Search vendor "Oracle" for product "Enterprise Manager Ops Center" and version "12.4.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Http Server Search vendor "Oracle" for product "Http Server" | 12.2.1.3.0 Search vendor "Oracle" for product "Http Server" and version "12.2.1.3.0" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Mysql Server Search vendor "Oracle" for product "Mysql Server" | <= 5.7.26 Search vendor "Oracle" for product "Mysql Server" and version " <= 5.7.26" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Mysql Server Search vendor "Oracle" for product "Mysql Server" | >= 5.7.27 <= 8.0.15 Search vendor "Oracle" for product "Mysql Server" and version " >= 5.7.27 <= 8.0.15" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Secure Global Desktop Search vendor "Oracle" for product "Secure Global Desktop" | 5.4 Search vendor "Oracle" for product "Secure Global Desktop" and version "5.4" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Services Tools Bundle Search vendor "Oracle" for product "Services Tools Bundle" | 19.2 Search vendor "Oracle" for product "Services Tools Bundle" and version "19.2" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 8.0 Search vendor "Redhat" for product "Enterprise Linux" and version "8.0" | - |
Affected
| ||||||