cURL FTP Pathname Heap Overflow Remote Code Execution Vulnerability [CVE-2018-1000120]
CVE Number – CVE-2018-1000120
A vulnerability in cURL could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system.
The vulnerability is due to an insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by submitting a crafted FTP pathname to the affected system. A successful exploit could cause a heap overflow condition, which could allow the attacker to execute arbitrary code on the targeted system.
The cURL Project has confirmed this vulnerability and released software updates.
-
To exploit this vulnerability, an attacker must submit a crafted FTP pathname to the targeted system, making exploitation more difficult in environments that restrict network access from untrusted sources.
-
Administrators are advised to apply the appropriate updates.
Administrators are advised to allow only trusted users to access network systems.
Administrators are advised to monitor affected systems.
-
The cURL Project has released a security advisory at the following link: FTP path trickery leads to NIL byte out of bounds write
-
-
The cURL Project has released a software patch at the following link: cURL v7.59.0
-
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.