CVE-2017-1000100

Name of the Vulnerable Software and Affected Versions libcurl versions prior to the fixed version

Description The issue is related to a buffer overflow when using the TFTP protocol with libcurl. When a URL contains a very long file name (longer than about 515 bytes), the file name is truncated, but the buffer size is still updated to use the original length. This causes the sendto() function to read beyond the end of the heap-based buffer. A malicious HTTP(S) server could exploit this by redirecting a vulnerable libcurl-using client to a crafted TFTP URL, potentially allowing the server to receive private memory contents over UDP.

Recommendations For libcurl versions prior to the fixed version: Limit curl's redirect protocols with --proto-redir and libcurl's with CURLOPT REDIR PROTOCOLS to prevent exploitation. As a temporary workaround, consider restricting the use of the TFTP protocol to minimize the risk of exploitation.