8 ms·
Libcurl remote code execution
- roel_v 14y agoI guess I'm just a dumbass, but does the linked PoC do more than just overwrite EIP with 'A'? Is the payload left as an exercise for the reader or is this a working example and am I missing something clever?
- anyfoo 14y agoThe stack was overwritten with 'A's, and thus upon returning from a function the return address consisted entirely of 'A's, which is why EIP is now filled with it. A clever hacker would use this to jump into some malicious code instead; that's how stack overflow exploits usually work. So, yes, the actual payload is left as an exercise for the reader, but this shows that there's already everything there to make it possible.
- roel_v 14y agoOh OK, then I did see correctly after all. But still, on many modern systems (e.g. with non-executable stack) it would require fairly sophisticated trickery in the payload to make this do anything. I mean, getting control over EIP is a very good first step, but this isn't 1995.
- darkarmani 14y agoGenerally it is considered good form to release PoC exploit code that illustrates the weakness without causing significant harm. The buffer overflow is the demonstration. There is enough other work that shows how to create payloads.
- mmastrac 14y agoSo apparently cURL speaks POP3. I had no idea until seeing this. This might be useful to know for future projects.
- mattlong 14y agoFYI, `curl --version` shows all the protocols it supports
- grn 14y agoOn my Debian Squeeze I get the following: $ curl --version curl 7.21.0 (x86_64-pc-linux-gnu) libcurl/7.21.0 OpenSSL/0.9.8o zlib/1.2.3.4 libidn/1.15 libssh2/1.2.6 Protocols: dict file ftp ftps http https imap imaps ldap ldaps pop3 pop3s rtsp scp sftp smtp smtps telnet tftp Features: GSS-Negotiate IDN IPv6 Largefile NTLM SSL libz Looks pretty impressive.
- agwa 14y agoThis is nasty but fortunately it only affects fairly recent versions of curl, specifically curl 7.26.0 up to and including 7.28.1. That means Debian Stable and Ubuntu 12.04 aren't affected. As a general rule, if you use libcurl in an application and follow redirects you should probably restrict CURLOPT_REDIR_PROTOCOLS to just HTTP and HTTPS (and maybe FTP). Otherwise a nefarious site could redirect curl to, for example, a IMAP, POP, or SMTP URL, which is potentially undesirable even without this vulnerability. If you're just using curl to talk HTTP(S) you really don't need any of these other protocols.
- jimrandomh 14y agoThus illustrating, once again, that the C programming language is unfit for network-facing software and that using it in that role is irresponsible.
- mattlong 14y agoWhat is a suitable alternative?
- dphase 14y agoI'm not sure, but I think we should spearhead an effort to rewrite the Linux TCP/IP stack in Forth.
- haimez 14y agoLet's add some more obscurity to this security. I suggest APL.
- daeken 14y agoC++. I hate it, it has its own host of problems, and memory corruption is certainly still an issue there, but the most common issues that plague C apps won't plague properly written C++ apps/libraries. C's string handling (or lack thereof) has cost the world an immeasurable amount of time and money. The biggest advantage that C++ has over just about everything else, is that you can use it to write libraries usable from everything else, and you can do it very easily. You can expose a C-style API trivially, and bind it to everything you want; that advantage can't be overstated. While I'd love for everything to be written in pure safe, managed code, that's not viable right now. C++ is the best alternative we have, when safe languages aren't usable for the task.
- pjungwir 14y ago> the most common issues that plague C apps won't plague properly written C++ or properly written C, either. :-)
- 14y ago
- javajosh 14y agoMitigation: wget.
- jeswin 14y agocurl is still the best tool for file downloads. wget lacks some fairly important features, like limiting the size downloads. To be checked if you are worried about bandwidth or disk quota.
- barrkel 14y agocurl --max-filesize: "NOTE: The file size is not always known prior to download, and for such files this option has no effect even if the file transfer ends up being larger than this given limit. This concerns both FTP and HTTP transfers." wget --quota: "Note that quota will never affect downloading a single file. However, quota is respected when retrieving either recursively, or from an input file." These options are not that much different in practice. If single-file size is uber-important, pipe it through something that will break the pipe after the limit point. For ad-hoc scripting usage, wget is almost always more usable than curl IMO. Of course, wget isn't a library.
- ibrahima 14y agoThis is a flaw in libcURL, and last I checked wget was just a binary, not a cross platform library.
- X-Istence 14y agoNot having wget installed stops about 60% of the PHP shell scripts I've seen dropped on servers.
- wereHamster 14y agoSomebody wrote new code which uses strcat() in 2012 (the commit which introduced that bug was written in June 2012)? That's.. wow.. unbelievable.
- xxpor 14y agoIs this kind of stuff not code reviewed?
- nolok 14y agoIt's an open source project, you are free to do so if you have the time or the need, and contribute back any corrections.
- xxpor 14y agoI guess I'm just idealistic, but I would think for something this security sensitive or important (see "Fixing" TWO in glibc), they would have code reviews before anything could be committed. In this case, a automated system rejecting anything that uses the non "n"(strcat vs strncat, etc.) version of the string functions in C would have worked.
- peterwwillis 14y agoIf you expect code reviews and automated tests for an open-source product that's developed in spare time for no money, you can go to this page (http://curl.haxx.se/donation.html http://curl.haxx.se/donation.html), click the PayPal button, and be very very generous.
- agwa 14y agoThis is only a partially-accurate description of how most open source projects work. While code review of the core developers is rare, patches from outside contributors typically are scrutinized before being applied. The curl vulnerability was introduced by an outsider's patch so I am troubled that it wasn't noticed before being committed.
- deleted 14y ago[deleted]
- rachelbythebay 14y agoRegarding version numbers, I'll mention something here that I used to have to tell customers in the web hosting biz all the time: stuff sometimes gets backported and version numbers don't tell the whole story. For instance, RHEL 5 has "curl-7.15.5-15.el5" right now, and that would suggest it doesn't support either of the CURLOPTS required to disable this. However, the actual build loops in a patch called curl-7.15.5-CVE-2009-0037.patch, and that adds in all of the CURLPROTO_* magic required to lock down an application. I discovered this tonight when updating my client-side code to restrict redirects and found that it would build fine on RHEL 5 even though I expected it to die. A little digging around in the source RPM explained it. So, if you're on an OS like RHEL and you think you might not be able to use this feature, try looking in your curl.h file. You might actually have support courtesy of some backported patch from your distributor.
- rmccue 14y agoIf there's anyone using my Requests for PHP library [0], just an FYI that it is not vulnerable to this as it handles redirection outside of cURL and double-checks all URLs. That said, I'll be pushing some commits momentarily to ensure that this is also forced via CURLOPT_PROTOCOLS inside the cURL transport. [0]: http://requests.ryanmccue.info/ http://requests.ryanmccue.info/
- deleted 14y ago[deleted]
- jackowayed 14y agoI've been reading more about security lately, and one thing I don't understand is how buffer overflows allow for true RCE these days. I believe all modern processors support having non-executable pages; why is any program-writeable page executable? Especially in C, where there's no JIT. It also seems like address space randomization would make RCE pretty hard. Obviously they can still arbitrarily write the instruction pointer, which is very bad and possibly bootstrappable into fully RCE, but I still see more conventional RCE described in recent books and wonder if and why it's still doable.
- grn 14y agoHere you can read about defeating the protections you mentioned: http://www.blackhat.com/presentations/bh-europe-09/Fritsch/Blackhat-Europe-2009-Fritsch-Buffer-Overflows-Linux-whitepaper.pdf http://www.blackhat.com/presentations/bh-europe-09/Fritsch/B...
- ctz 14y agoYou should distinguish RCE and the ability to mount working, reliable exploits. RCE is possible here, and its best to consider that a fatal security failing in and of itself rather than hoping a particular set of countermeasures will be completely effective. NX pages would make some classes of RCE exploit difficult or hard (such as including shellcode directly in the POP3 response, and returning directly to it) but doesn't help for many other classes (return-to-libc, or finding or installing 'gadgets' elsewhere in executable pages). ASLR is a working countermeasure for other classes of exploit, as long as addresses are unpredictable enough to make a search is hard.
- wingo 14y agoYou can redirect the control-flow of the program by overwriting a return address or a vtable. Once you've done that, it's easiest if you can redirect control to code you've written, in executable heap; but if that's not possible, you can still use return-to-libc, or potentially "return-oriented programming" strategies.
- lenkite 14y agoI hate the fact that most of the C standard library needs to be ignored due to buffer overflow/security issues. I nearly always use the cross platform "Safe C Library" anytime I do something in C: http://sourceforge.net/projects/safeclib/ http://sourceforge.net/projects/safeclib/ http://www.drdobbs.com/cpp/the-safe-c-library/214502214 http://www.drdobbs.com/cpp/the-safe-c-library/214502214
- stcredzero 14y agoSeems OS X 10.8.2 is unaffected. curl --version Gives me 7.24 or so.