vulnwire
8.8high

CVE-2005-0490

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execut…

Published 21 y ago · modified 4 mo ago · JSON

CVSS
8.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
5.7%
percentile 93%
Public exploits
0
none known

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.

Exploit prediction (EPSS)

5.73% probability of exploitation in the next 30 days, higher than 93% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.18.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.05.1AV:N/AC:H/Au:N/C:P/I:P/A:P

Classification

Weakness
  • CWE-131 Incorrect Calculation of Buffer Size

References

  • marc.info /?l=full-disclosure&m=110959085507755&w=2 · mailing-list, x_refsource_FULLDISC, x_transferred
  • distro.conectiva.com.br /atualizacoes/?id=a&anuncio=000940 · vendor-advisory, x_refsource_CONECTIVA, x_transferred
  • idefense.com /application/poi/display?id=202&type=vulnerabilities · third-party-advisory, x_refsource_IDEFENSE, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10273 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • securityfocus.com /bid/12616 · vdb-entry, x_refsource_BID, x_transferred
  • securityfocus.com /bid/12615 · vdb-entry, x_refsource_BID, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/19423 · vdb-entry, x_refsource_XF, x_transferred
  • idefense.com /application/poi/display?id=203&type=vulnerabilities · third-party-advisory, x_refsource_IDEFENSE, x_transferred
  • mandriva.com /security/advisories?name=MDKSA-2005:048 · vendor-advisory, x_refsource_MANDRAKE, x_transferred
  • gentoo.org /security/en/glsa/glsa-200503-20.xml · vendor-advisory, x_refsource_GENTOO, x_transferred
  • redhat.com /support/errata/RHSA-2005-340.html · vendor-advisory, x_refsource_REDHAT, x_transferred
  • novell.com /linux/security/advisories/2005_11_curl.html · vendor-advisory, x_refsource_SUSE, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.