CVE-2019-3823

Vulnerability

A heap out-of-bounds read vulnerability exists in libcurl versions 7.34.0 through 7.63.0 inclusive in the smtp_endofresp() function that handles SMTP end-of-response checking [1], [2], [3]. If the buffer passed to smtp_endofresp() is not NUL terminated and contains no character ending the parsed number, and the len parameter is set to 5, then the strtol() call reads beyond the allocated buffer [3].

Exploitation

An attacker must be able to trigger a specific SMTP response that lacks certain terminators, and the len value in the SMTP protocol implementation must be 5 [1], [2]. No authentication is required beyond network access to an SMTP server that responds with crafted data. The read content from out-of-bounds is not returned to the caller but could potentially be observed through side effects or crashes [3].

Impact

Successful exploitation leads to out-of-bounds heap read, which may cause a denial of service (crash) or expose sensitive heap data [1], [2], [3]. The CVSS score is 5.3 (medium), and the CWE is 125 (Out-of-bounds Read) [3].

Mitigation

Fixed in libcurl 7.64.0, released February 6, 2019 [3]. Users should upgrade to version 7.64.0 or later [3], [4]. Alternatively, apply the patch from commit 39df4073e5413fcdbb5a38d [3]. A workaround is to disable SMTP usage or SMTP authentication if possible [2]. Gentoo users should emerge >=net-misc/curl-7.64.0 [4].