CVE-2017-1000100
Description
When doing a TFTP transfer and curl/libcurl is given a URL that contains a very long file name (longer than about 515 bytes), the file name is truncated to fit within the buffer boundaries, but the buffer size is still wrongly updated to use the untruncated length. This too large value is then used in the sendto() call, making curl attempt to send more data than what is actually put into the buffer. The endto() function will then read beyond the end of the heap based buffer. A malicious HTTP(S) server could redirect a vulnerable libcurl-using client to a crafted TFTP URL (if the client hasnt restricted which protocols it allows redirects to) and trick it to send private memory contents to a remote server over UDP. Limit curls redirect protocols with --proto-redir and libcurls with CURLOPT_REDIR_PROTOCOLS.
Risk Information
Base Score
6.5
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
0.962
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Multiple Vulnerabilities are affected in Curl For Windows 7.50.3 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.21.6 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.21.4 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.21.5 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.21.7 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.22.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.23.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.23.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.24.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.25.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.26.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.27.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.28.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.28.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.29.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.30.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.31.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.32.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.33.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.17.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.18.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.18.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.18.2 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.19.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.19.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.19.2 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.19.3 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.19.4 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.19.5 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.19.6 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.19.7 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.20.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.20.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.21.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.21.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.21.2 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.21.3 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.34.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.35.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.36.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.37.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.37.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.38.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.15.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.15.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.15.2 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.15.3 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.15.4 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.15.5 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.16.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.16.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.16.2 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.16.3 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.16.4 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.17.0 | Windows |
| Vulnerabilities CVE-2014-8150,CVE-2014-8151,CVE-2017-1000100,CVE-2017-1000254 are affected in Curl For Windows 7.39 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.50.0 | Windows |
| Vulnerabilities CVE-2016-7141,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.50.1 | Windows |
| Vulnerabilities CVE-2016-7167,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.50.2 | Windows |
| Vulnerabilities CVE-2017-1000099,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.54.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.40.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.41.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.42.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.42.1 | Windows |
| Vulnerabilities CVE-2016-3739,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.43.0 | Windows |
| Vulnerabilities CVE-2016-3739,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.44.0 | Windows |
| Vulnerabilities CVE-2016-3739,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.45.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.46.0 | Windows |
| Vulnerabilities CVE-2016-3739,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.47.0 | Windows |
| Vulnerabilities CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.47.1 | Windows |
| Vulnerabilities CVE-2016-3739,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.48.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.49.0 | Windows |
| Vulnerabilities CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.49.1 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.51.0 | Windows |
| Vulnerabilities CVE-2016-9594,CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.52.0 | Windows |
| Vulnerabilities CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254,CVE-2017-2629 are affected in Curl For Windows 7.52.1 | Windows |
| Vulnerabilities CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254 are affected in Curl For Windows 7.53.0 | Windows |
| Multiple Vulnerabilities are affected in Curl For Windows 7.53.1 | Windows |
| Vulnerabilities CVE-2017-1000100,CVE-2017-1000101,CVE-2017-1000254,CVE-2017-9502 are affected in Curl For Windows 7.54.0 | Windows |
| Vulnerabilities CVE-2017-1000101,CVE-2017-1000100,CVE-2017-1000099 are fixed in Curl For Windows 7.55.0 | Windows |
| Multiple vulnerabilities are fixed in macOS High Sierra 10.13.1 | Mac |
| Multiple vulnerabilities are fixed in Security Update 2017-001 macOS High Sierra v10.13.1 | Mac |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.47.0-1ubuntu2.3_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.47.0-1ubuntu2.3_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.52.1-4ubuntu1.2_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.52.1-4ubuntu1.2_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.35.0-1ubuntu2.11_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) curl_7.35.0-1ubuntu2.11_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.47.0-1ubuntu2.3_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.47.0-1ubuntu2.3_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.52.1-4ubuntu1.2_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.52.1-4ubuntu1.2_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.35.0-1ubuntu2.11_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3_7.35.0-1ubuntu2.11_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.47.0-1ubuntu2.3_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.47.0-1ubuntu2.3_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.52.1-4ubuntu1.2_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.52.1-4ubuntu1.2_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.35.0-1ubuntu2.11_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-nss_7.35.0-1ubuntu2.11_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.47.0-1ubuntu2.3_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.47.0-1ubuntu2.3_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.52.1-4ubuntu1.2_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.52.1-4ubuntu1.2_amd64.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.35.0-1ubuntu2.11_i386.deb | Linux |
| HTTP, HTTPS, and FTP client and client libraries (USN-3441-1) libcurl3-gnutls_7.35.0-1ubuntu2.11_amd64.deb | Linux |
| curl security update(DSA-3992-1) curl_7.52.1-5_i386.deb | Linux |
| curl security update(DSA-3992-1) curl_7.38.0-4+deb8u6_i386.deb | Linux |
| Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-1000100) | NCM |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-601562 | macOS High Sierra 10.13.6 - Reboot Automatically |
| PATCH-601312 | Security Update 2017-001 macOS High Sierra v10.13.1 |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234