Buffer overflow in Haxx Libcurl
CVE-2019-3822
libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The function creating an outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents based on previously received data. The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening. This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.129 (96.3th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 96th percentile — 96.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.129 · newest: 0.129 · change: 0.000
Affected products
- Haxx Libcurl
- NetApp Active Iq Unified Manager
- NetApp Clustered Data Ontap
- NetApp Oncommand Insight
- NetApp Oncommand Workflow Automation
- NetApp Snapcenter
- Oracle Communications Operations Monitor — versions 3.4, 4.0
- Oracle Enterprise Manager Ops Center — versions 12.3.3, 12.4.0
- Oracle HTTP Server — versions 12.2.1.3.0
- Oracle MySQL Server
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security.gentoo.org/glsa/201903-03 (vendor-advisory, Third Party Advisory)
- bugzilla.redhat.com/show_bug.cgi (Exploit, Patch, Third Party Advisory, Issue Tracking)
- www.debian.org/security/2019/dsa-4386 (vendor-advisory, Third Party Advisory)
- curl.haxx.se/docs/CVE-2019-3822.html (Patch, Vendor Advisory)
- security.netapp.com/advisory/ntap-20190315-0001/ (Patch, Third Party Advisory)
- usn.ubuntu.com/3882-1/ (vendor-advisory, Third Party Advisory)
- www.securityfocus.com/bid/106950 (VDB Entry, Third Party Advisory, vdb-entry)
- lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f37fa1ecc89… (mailing-list)
- cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf (Third Party Advisory)
- www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html (Patch, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-3822?
- CVE-2019-3822 is a critical-severity vulnerability in Haxx Libcurl, classified under Stack-based Buffer Overflow. CVSS score: 9.8/10. Published 2019-02-06.
- How severe is CVE-2019-3822?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2019-3822 known to be exploited?
- 10 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.