Strix
26.1K

CVE-2017-1000100

MEDIUMCVSS 6.5/10EPSS 3.96%

Last modified

CVE-2017-1000100 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. EPSS estimates a 3.96% chance of exploitation in the next 30 days.

Description

When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.

Metrics

CVSS 3.1
6.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS Probability
3.96%

89.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
HaxxLibcurl7.15.0
HaxxLibcurl7.15.1
HaxxLibcurl7.15.2
HaxxLibcurl7.15.3
HaxxLibcurl7.15.4
HaxxLibcurl7.15.5
HaxxLibcurl7.16.0
HaxxLibcurl7.16.1
HaxxLibcurl7.16.2
HaxxLibcurl7.16.3
HaxxLibcurl7.16.4
HaxxLibcurl7.17.0
HaxxLibcurl7.17.1
HaxxLibcurl7.18.0
HaxxLibcurl7.18.1
HaxxLibcurl7.18.2
HaxxLibcurl7.19.0
HaxxLibcurl7.19.1
HaxxLibcurl7.19.2
HaxxLibcurl7.19.3
HaxxLibcurl7.19.4
HaxxLibcurl7.19.5
HaxxLibcurl7.19.6
HaxxLibcurl7.19.7
HaxxLibcurl7.20.0
HaxxLibcurl7.20.1
HaxxLibcurl7.21.0
HaxxLibcurl7.21.1
HaxxLibcurl7.21.2
HaxxLibcurl7.21.3
HaxxLibcurl7.21.4
HaxxLibcurl7.21.5
HaxxLibcurl7.21.6
HaxxLibcurl7.21.7
HaxxLibcurl7.22.0
HaxxLibcurl7.23.0
HaxxLibcurl7.23.1
HaxxLibcurl7.24.0
HaxxLibcurl7.25.0
HaxxLibcurl7.26.0
HaxxLibcurl7.27.0
HaxxLibcurl7.28.0
HaxxLibcurl7.28.1
HaxxLibcurl7.29.0
HaxxLibcurl7.30.0
HaxxLibcurl7.31.0
HaxxLibcurl7.32.0
HaxxLibcurl7.33.0
HaxxLibcurl7.34.0
HaxxLibcurl7.35.0

Showing 50 of 79 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2017-1000100?
When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn't restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT_REDIR_PROTOCOLS.
How severe is CVE-2017-1000100?
CVE-2017-1000100 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 3.96% probability of exploitation in the next 30 days.
How do I fix CVE-2017-1000100?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-1000100?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST