CVE-2017-1000254

Vulnerability

When libcurl connects to an FTP server and successfully logs in (anonymous or not), it sends the PWD command to request the current directory path. The server replies with a 257 response containing the path enclosed in double quotes. Due to a flaw in the string parser introduced in commit 415d2e7cb7 (March 2005), if the directory name is provided without a closing double quote, libcurl fails to append a trailing NUL byte to the heap-allocated buffer holding the name. Affected versions are libcurl 7.7 through 7.55.1; versions before 7.7 and from 7.56.0 onward are not affected [4]. The bug was fixed in commit 5ff2c5ff25750aba1a8f64 and released in curl 7.56.0 [4].

Exploitation

An attacker must operate a malicious FTP server that accepts login (anonymous or otherwise) and provides a malformed 257 response to the mandatory PWD command—specifically a path string that lacks the closing double quote. No authentication beyond the FTP login is required, as the PWD command is always issued on every new FTP connection. The parser flaw results in a missing NUL terminator, and when libcurl subsequently accesses the stored path string, it reads beyond the allocated heap buffer [4]. The attacker does not need to control the client beyond serving the malicious response; no user interaction beyond initiating an FTP transfer is required.

Impact

A successful attack causes a heap buffer over-read, potentially leading to a segmentation fault and denial of service for any libcurl-based application performing FTP operations against the malicious server. The over-read could also allow the server to retrieve out-of-bounds data from the client's heap, though the advisory notes no known exploit for information disclosure [4]. The primary impact is denial of service due to crashes; the chance of triggering a segfault is high.

Mitigation

The vulnerability is fixed in curl version 7.56.0 (released 2017-10-04) [4]. Users should upgrade to this version or later. For systems that cannot be immediately upgraded, the patch from commit 5ff2c5ff25750aba1a8f64 can be applied. Red Hat has shipped the fix in httpd24-curl 7.61.1 (RHSA-2018:3558 [1]) and in JBoss Core Services Apache HTTP Server 2.4.29 (RHSA-2018:2486 [3]). Apple included the fix in macOS High Sierra 10.13.2 and Security Updates 2017-002/005 (HT208331 [2]). There is no known workaround other than avoiding use of FTP with libcurl on unpatched versions.