CVE-2016-8622

Vulnerability

The URL percent-encoding decode function curl_easy_unescape in libcurl versions before 7.51.0 contains an integer truncation vulnerability. When decoding a very large URL, the function may allocate a destination buffer larger than 2GB, but the returned length is stored in a signed 32-bit integer variable. This causes the length to be truncated or become negative, leading to a heap buffer overflow when libcurl writes the decoded data [4]. Affected versions: libcurl < 7.51.0.

Exploitation

An attacker on a 64-bit system who can supply a custom, very large URL to a program using libcurl can trigger the vulnerability. No authentication is required if the program processes user-supplied URLs. The attacker must craft a URL that causes the decoded output to exceed 2GB, causing integer truncation [4]. The vulnerability is reachable via any application that uses curl_easy_unescape on attacker-controlled input.

Impact

Successful exploitation results in a heap buffer overflow, potentially allowing arbitrary code execution or denial of service. The attacker may write out-of-bounds, compromising confidentiality, integrity, and availability of the affected system [1][2][3].

Mitigation

Fixed in libcurl version 7.51.0, released on November 2, 2016 [4]. Red Hat has provided updates via RHSA-2018:3558 for httpd24-curl [1] and RHSA-2018:2486 for JBoss Core Services [2]. Tenable LCE 4.8.2 also includes the fix [3]. Users should upgrade to patched versions. No workaround is available.