CVE Vulnerability

CVE-2018-14618

curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)

10 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://curl.haxx.se/docs/CVE-2018-14618.html Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618 Issue Tracking
https://www.debian.org/security/2018/dsa-4286 Third Party Advisory
http://www.securitytracker.com/id/1041605 Third Party Advisory VDB Entry
https://usn.ubuntu.com/3765-1/ Third Party Advisory
https://usn.ubuntu.com/3765-2/ Third Party Advisory
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:3558 Third Party Advisory
https://security.gentoo.org/glsa/201903-03 Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf
https://access.redhat.com/errata/RHSA-2019:1880
Configurations

Configuration 1

cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*
Information

Published : 2018-09-05 07:29

Updated : 2019-04-22 05:48

NVD link : CVE-2018-14618

Mitre link : CVE-2018-14618

Products Affected
No products.
CWE
CWE-190