When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The sendto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasn\'t restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curl\'s redirect protocols with --proto-redir and libcurl\'s with CURLOPT_REDIR_PROTOCOLS. We are not aware of any exploit of this flaw.
Find out more about CVE-2017-1000100 from the MITRE-CVE dictionary and NIST NVD
Login may be required to access defects or downloads.
| Product Name | Status | Defect | Fixed | Downloads |
|---|---|---|---|---|
| Linux | ||||
| Wind River Linux LTS 17 | Fixed | -- | 10.17.41.1 | -- |
| Wind River Linux 8 | Fixed |
LIN8-7405 |
8.0.0.21 | -- |
| Wind River Linux 9 | Fixed |
LIN9-5029 |
9.0.0.10 | -- |
| Wind River Linux 7 | Fixed | -- | 7.0.0.26 | -- |
| Wind River Linux LTS 21 | Not Vulnerable | -- | -- | -- |
| Wind River Linux LTS 22 | Not Vulnerable | -- | -- | -- |
| Wind River Linux LTS 18 | Fixed | -- | 10.18.44.1 | -- |
| Wind River Linux LTS 19 | Not Vulnerable | -- | -- | -- |
| Wind River Linux CD release | Not Vulnerable | -- | -- | -- |
| Wind River Linux 6 | Fixed | -- | 6.0.0.35 | -- |
| Wind River Linux LTS 23 | Not Vulnerable | -- | -- | -- |
| VxWorks | ||||
| VxWorks 7 | Fixed | -- | webcli_curl-7.55.1.0 | -- |
| VxWorks 6.9 | Vulnerable | -- | -- | -- |
| Helix Virtualization Platform Cert Edition | ||||
| Helix Virtualization Platform Cert Edition | Not Vulnerable | -- | -- | -- |
| Product Name | Status | Defect | Fixed | Downloads |
|---|
