KLA10750 Data manipulations vulnerability in cURL

Lack of data sanitization was found in cURL command line tool for Windows. By exploiting this vulnerability malicious users can write arbitrary local file. This vulnerability can be exploited remotely via a specially designed file name.

Technical details

cURL does not sanitize colons in a remote file name when options -O or -OJ is used and remote file name contains colons. This vulnerability is exploitable only on Windows cause it’s the only system which interprets colon as mark of drive letter. You can look for multiple technical details, examples and recommendations at original vendor advisory.

Original advisories

Vendor advisory

Related products

cURL

CVE list

CVE-2016-0754 warning

Solution

Update to the latest version, avoid using -O and -OJ parameters or apply patch listed in original advisory and rebuild.

cURL download page

Impacts

• WLF

Write Local Files. Exploitation of vulnerabilities with this impact can lead to writing into some inaccessible files. Files that can be read depends on concrete program errors.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• cURL command line tool for Windows versions earlier than 7.47.0