CVE-2017-8816
published 2017-11-29CVE-2017-8816: The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and…
PriorityP434critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.45%
64.4th percentile
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.
Affected
28 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | macos_high_sierra_10.13.3_security_update_2018-001_sierra_and_security_update_20 | — | — |
| apple | macos_high_sierra_10.13.4_security_update_2018-002_sierra_and_security_update_20 | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | curl | < curl 7.57.0-1 (bookworm) | curl 7.57.0-1 (bookworm) |
| debian | curl | < curl 7.62.0-1 (bookworm) | curl 7.62.0-1 (bookworm) |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| haxx | curl | <= 7.56.1 | — |
| haxx | curl | >= 0 < 7.62.0-1 | 7.62.0-1 |
| haxx | curl | >= 0 < 7.57.0-1 | 7.57.0-1 |
| haxx | curl | >= 0 < 7.62.0-1 | 7.62.0-1 |
| haxx | curl | >= 0 < 7.57.0-1 | 7.57.0-1 |
| haxx | curl | >= 0 < 7.62.0-1 | 7.62.0-1 |
| haxx | curl | >= 0 < 7.57.0-1 | 7.57.0-1 |
| haxx | curl | >= 0 < 7.62.0-1 | 7.62.0-1 |
| haxx | curl | >= 0 < 7.57.0-1 | 7.57.0-1 |
| haxx | curl | >= 0 < 7.35.0-1ubuntu2.13 | 7.35.0-1ubuntu2.13 |
| haxx | curl | >= 0 < 7.47.0-1ubuntu2.5 | 7.47.0-1ubuntu2.5 |
| haxx | libcurl | < 7.61.1 | 7.61.1 |
| haxx | libcurl | 7.36.0 – 7.56.1 | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_ubuntu9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
cURL/libcURL up to 7.56.x on 32-bit NTLM Authentication integer overflow (RHSA-2018:3558 / Nessus ID 104861)
vuldb·2026-04-16·CVSS 9.8
CVE-2017-8816 [CRITICAL] cURL/libcURL up to 7.56.x on 32-bit NTLM Authentication integer overflow (RHSA-2018:3558 / Nessus ID 104861)
A vulnerability described as critical has been identified in cURL and libcURL up to 7.56.x on 32-bit. This affects an unknown function of the component NTLM Authentication. The manipulation results in integer overflow.
This vulnerability is reported as CVE-2017-8816. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
VulDB
Apple macOS up to 10.13.4 curl integer overflow (HT208692 / Nessus ID 105264)
vuldb·2026-04-16·CVSS 9.8
CVE-2017-8816 [CRITICAL] Apple macOS up to 10.13.4 curl integer overflow (HT208692 / Nessus ID 105264)
A vulnerability, which was classified as critical, was found in Apple macOS up to 10.13.4. The affected element is an unknown function of the component curl. Such manipulation leads to integer overflow.
This vulnerability is listed as CVE-2017-8816. The attack may be performed from remote. There is no available exploit.
A patch should be applied to remediate this issue.
GHSA
GHSA-2546-5j9r-qggh: The NTLM authentication feature in curl and libcurl before 7
ghsa_unreviewed·2022-05-14
CVE-2017-8816 [CRITICAL] CWE-190 GHSA-2546-5j9r-qggh: The NTLM authentication feature in curl and libcurl before 7
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.
GHSA
GHSA-4mp9-8964-jxmg: curl before version 7
ghsa_unreviewed·2022-05-14·CVSS 9.8
CVE-2018-14618 [CRITICAL] CWE-190 GHSA-4mp9-8964-jxmg: curl before version 7
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)
OSV
CVE-2018-14618: curl before version 7
osv·2018-09-05·CVSS 9.8
CVE-2018-14618 [CRITICAL] CVE-2018-14618: curl before version 7
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)
OSV
curl vulnerabilities
osv·2017-11-29·CVSS 9.8
CVE-2017-8816 [CRITICAL] curl vulnerabilities
curl vulnerabilities
Alex Nichols discovered that curl incorrectly handled NTLM authentication
credentials. A remote attacker could use this issue to cause curl to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 16.04 LTS, Ubuntu 17.04 and Ubuntu 17.10.
(CVE-2017-8816)
It was discovered that curl incorrectly handled FTP wildcard matching. A
remote attacker could use this issue to cause curl to crash, resulting in a
denial of service, or possibly obtain sensitive information.
(CVE-2017-8817)
OSV
CVE-2017-8816: The NTLM authentication feature in curl and libcurl before 7
osv·2017-11-29·CVSS 9.8
CVE-2017-8816 [CRITICAL] CVE-2017-8816: The NTLM authentication feature in curl and libcurl before 7
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.
Red Hat
curl: NTLM password overflow via integer overflow
vendor_redhat·2018-09-05·CVSS 9.8
CVE-2018-14618 [CRITICAL] CWE-131 curl: NTLM password overflow via integer overflow
curl: NTLM password overflow via integer overflow
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical
Apple
CVE-2017-8816: macOS High Sierra 10.13.4, Security Update 2018-002 Sierra, and Security Update 2018-002 El Capitan
vendor_apple·2018-03-29·CVSS 9.8
CVE-2017-8816 [CRITICAL] CVE-2017-8816: macOS High Sierra 10.13.4, Security Update 2018-002 Sierra, and Security Update 2018-002 El Capitan
Apple Security Update: About the security content of macOS High Sierra 10.13.4, Security Update 2018-002 Sierra, and Security Update 2018-002 El Capitan
Product: macOS High Sierra 10.13.4, Security Update 2018-002 Sierra, and Security Update 2018-002 El Capitan
CVE: CVE-2017-8816
Component: CoreTypes
Impact: Processing a maliciously crafted webpage may result in the mounting of a disk image
Description: A logic issue was addressed with improved restrictions.
Apple
CVE-2017-8816: macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
vendor_apple·2018-01-23·CVSS 9.8
CVE-2017-8816 [CRITICAL] CVE-2017-8816: macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
Apple Security Update: About the security content of macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
Product: macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and Security Update 2018-001 El Capitan
CVE: CVE-2017-8816
Component: Audio
Impact: Processing a maliciously crafted audio file may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
Debian
CVE-2018-14618: curl - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authent...
vendor_debian·2018·CVSS 9.8
CVE-2018-14618 [CRITICAL] CVE-2018-14618: curl - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authent...
curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816.)
Scope: local
bookworm: resolved
Red Hat
curl: NTLM buffer overflow via integer overflow
vendor_redhat·2017-11-29·CVSS 9.8
CVE-2017-8816 [CRITICAL] CWE-190 curl: NTLM buffer overflow via integer overflow
curl: NTLM buffer overflow via integer overflow
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.
Package: rh-dotnetcore10-curl (.NET Core 1.0 on Red Hat Enterprise Linux) - Out of support scope
Package: rh-dotnetcore11-curl (.NET Core 1.1 on Red Hat Enterprise Linux) - Out of support scope
Package: rh-dotnet20-curl (.NET Core 2.0 on Red Hat Enterprise Linux) - Out of support scope
Package: rh-dotnet21-curl (.NET Core 2.1 on Red Hat Enterprise Linux) - Will not fix
Package: curl (Red Hat Enterprise Linux 5) - Not affected
Package: curl (R
Ubuntu
curl vulnerabilities
vendor_ubuntu·2017-11-29·CVSS 9.8
CVE-2017-8816 [CRITICAL] curl vulnerabilities
Title: curl vulnerabilities
Summary: Several security issues were fixed in curl.
Alex Nichols discovered that curl incorrectly handled NTLM authentication
credentials. A remote attacker could use this issue to cause curl to crash,
resulting in a denial of service, or possibly execute arbitrary code. This
issue only affected Ubuntu 16.04 LTS, Ubuntu 17.04 and Ubuntu 17.10.
(CVE-2017-8816)
It was discovered that curl incorrectly handled FTP wildcard matching. A
remote attacker could use this issue to cause curl to crash, resulting in a
denial of service, or possibly obtain sensitive information.
(CVE-2017-8817)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2017-8816: curl - The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit plat...
vendor_debian·2017·CVSS 9.8
CVE-2017-8816 [CRITICAL] CVE-2017-8816: curl - The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit plat...
The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resultant buffer overflow, and application crash) or possibly have unspecified other impact via vectors involving long user and password fields.
Scope: local
bookworm: resolved (fixed in 7.57.0-1)
bullseye: resolved (fixed in 7.57.0-1)
forky: resolved (fixed in 7.57.0-1)
sid: resolved (fixed in 7.57.0-1)
trixie: resolved (fixed in 7.57.0-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2018-14618 curl: NTLM password overflow via integer overflow
bugzilla·2018-08-27·CVSS 9.8
CVE-2018-14618 [CRITICAL] CVE-2018-14618 curl: NTLM password overflow via integer overflow
CVE-2018-14618 curl: NTLM password overflow via integer overflow
NTLM password overflow via integer overflow
Project curl Security Advisory, September 5th 2018 -
[Permalink](https://curl.haxx.se/docs/CVE-2018-XXXX.html)
VULNERABILITY
libcurl contains a buffer overflow in the NTLM authentication code.
The internal function `Curl_ntlm_core_mk_nt_hash` multiplies the `length` of
the password by two (SUM) to figure out how large temporary storage area to
allocate from the heap.
The `length` value is then subsequently used to iterate over the password and
generate output into the allocated storage buffer. On systems with a 32 bit
`size_t`, the math to calculate SUM triggers an integer overflow when the
password length exceeds 2GB (2^31 bytes). This integer overflow usually causes
a very s
Bugzilla
CVE-2017-8816 CVE-2017-8817 curl: various flaws [fedora-all]
bugzilla·2017-11-29·CVSS 9.8
CVE-2017-8816 [CRITICAL] CVE-2017-8816 CVE-2017-8817 curl: various flaws [fedora-all]
CVE-2017-8816 CVE-2017-8817 curl: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While
Bugzilla
CVE-2017-8816 CVE-2017-8817 mingw-curl: various flaws [epel-7]
bugzilla·2017-11-29·CVSS 9.8
CVE-2017-8816 [CRITICAL] CVE-2017-8816 CVE-2017-8817 mingw-curl: various flaws [epel-7]
CVE-2017-8816 CVE-2017-8817 mingw-curl: various flaws [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-7.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
Discussion:
Use the following template to for the 'fedpkg update' requ
Bugzilla
CVE-2017-8816 CVE-2017-8817 mingw-curl: various flaws [fedora-all]
bugzilla·2017-11-29·CVSS 9.8
CVE-2017-8816 [CRITICAL] CVE-2017-8816 CVE-2017-8817 mingw-curl: various flaws [fedora-all]
CVE-2017-8816 CVE-2017-8817 mingw-curl: various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora.
Bugzilla
CVE-2017-8816 curl: NTLM buffer overflow via integer overflow
bugzilla·2017-11-21·CVSS 9.8
CVE-2017-8816 [CRITICAL] CVE-2017-8816 curl: NTLM buffer overflow via integer overflow
CVE-2017-8816 curl: NTLM buffer overflow via integer overflow
libcurl contains a buffer overrun flaw in the NTLM authentication code.
The internal function `Curl_ntlm_core_mk_ntlmv2_hash` sums up the lengths of
the user name + password (= SUM) and multiplies the sum by two (= SIZE) to
figure out how large storage to allocate from the heap.
The SUM value is subsequently used to iterate over the input and generate
output into the storage buffer. On systems with a 32 bit `size_t`, the math to
calculate SIZE triggers an integer overflow when the combined lengths of the
user name and password is larger than 2GB (2^31 bytes). This integer overflow
usually causes a very small buffer to actually get allocated instead of the
intended very huge one, making the use of that buffer end up in a buffe
http://security.cucumberlinux.com/security/details.php?id=161http://www.securityfocus.com/bid/101998http://www.securitytracker.com/id/1039896http://www.securitytracker.com/id/1040608https://access.redhat.com/errata/RHSA-2018:3558https://curl.haxx.se/docs/adv_2017-12e7.htmlhttps://security.gentoo.org/glsa/201712-04https://www.debian.org/security/2017/dsa-4051http://security.cucumberlinux.com/security/details.php?id=161http://www.securityfocus.com/bid/101998http://www.securitytracker.com/id/1039896http://www.securitytracker.com/id/1040608https://access.redhat.com/errata/RHSA-2018:3558https://curl.haxx.se/docs/adv_2017-12e7.htmlhttps://security.gentoo.org/glsa/201712-04https://www.debian.org/security/2017/dsa-4051
2017-11-29
Published