CVE-2016-4802
HighSummary
Multiple untrusted search path vulnerabilities in cURL and libcurl before version 7.49.1 allow local users to execute arbitrary code and conduct DLL hijacking attacks when SSPI or telnet is enabled.
Risk Assessment
Organizations may be exposed to unauthorized code execution, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update cURL and libcurl to version 7.49.1 or later and to restrict access for local users to minimize risk.
Other vulnerabilities in cURL, libcurl
See all- CVE-2016-7141High
In curl and libcurl before version 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, remote attackers can hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set.
- CVE-2016-5420High
Versions of curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which may allow remote attackers to hijack the authentication of the connection.
- CVE-2016-5419High
curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, allowing remote attackers to bypass intended restrictions by resuming a session.
- CVE-2015-3145High
The sanitize_cookie_path function in cURL and libcurl versions 7.31.0 through 7.41.0 improperly calculates an index, which may lead to denial of service or other unspecified impacts via a cookie path containing only a double-quote character.
- CVE-2015-3144High
The fix_hostname function in cURL and libcurl versions 7.37.0 through 7.41.0 does not properly calculate an index, allowing remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name.
- CVE-2017-8818Critical
Versions of curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service through out-of-bounds access, leading to application crashes.
- CVE-2017-8817Critical
The FTP wildcard function in curl and libcurl before version 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.
- CVE-2017-8816Critical
The NTLM authentication feature in curl and libcurl before version 7.57.0 on 32-bit platforms allows attackers to cause a denial of service through integer overflow and resultant buffer overflow, leading to application crash.
Original NVD description (English source)
Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1, when built with SSPI or telnet is enabled, allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) security.dll, (2) secur32.dll, or (3) ws2_32.dll in the application or current working directory.