Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2018-14618: curl can overrun memory with extremely long passwords
CVE-2018-14618 · published 8 years ago
Summary
The curl library can allocate too little memory when a password longer than about 2 gigabytes is used, leading to a memory overflow. This could allow an attacker to crash or potentially execute code on systems that use curl for NTLM authentication. Update curl to the latest version or avoid using such extremely long passwords to mitigate the risk.
What to do
- Update debian curl to version 7.62.0-1.
- Update haxx libcurl to version 7.61.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | curl |
< 7.62.0-1 Fix: upgrade to 7.62.0-1
|
| Debian:13 | debian | curl |
< 7.62.0-1 Fix: upgrade to 7.62.0-1
|
| Debian:14 | debian | curl |
< 7.62.0-1 Fix: upgrade to 7.62.0-1
|
| – | haxx | libcurl |
< 7.61.1 cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
12.04 14.04 16.04 18.04 cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* |
| – | debian | debian_linux |
9.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| – | redhat | enterprise_linux |
6.0 7.0 7.4 7.5 7.6 cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* |
Original advisory text
NTLM password overflow via integer overflow
libcurl contains a buffer overrun in the NTLM authentication code.
The internal function `Curl_ntlm_core_mk_nt_hash` multiplies the `length` of
the password by two (SUM) to figure out how large temporary storage area to
allocate from the heap.
The `length` value is then subsequently used to iterate over the password and
generate output into the allocated storage buffer. On systems with a 32-bit
`size_t`, the math to calculate SUM triggers an integer overflow when the
password length exceeds 2GB (2^31 bytes). This integer overflow usually causes
a tiny buffer to actually get allocated instead of the intended huge one,
making the use of that buffer end up in a heap buffer overflow.
(This bug is almost identical to
[CVE-2017-8816](https://curl.se/docs/CVE-2017-8816.html).)
The internal function `Curl_ntlm_core_mk_nt_hash` multiplies the `length` of
the password by two (SUM) to figure out how large temporary storage area to
allocate from the heap.
The `length` value is then subsequently used to iterate over the password and
generate output into the allocated storage buffer. On systems with a 32-bit
`size_t`, the math to calculate SUM triggers an integer overflow when the
password length exceeds 2GB (2^31 bytes). This integer overflow usually causes
a tiny buffer to actually get allocated instead of the intended huge one,
making the use of that buffer end up in a heap buffer overflow.
(This bug is almost identical to
[CVE-2017-8816](https://curl.se/docs/CVE-2017-8816.html).)
References
- http://www.securitytracker.com/id/1041605 Third Party Advisory VDB Entry
- https://access.redhat.com/errata/RHSA-2018:3558 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2018-14618 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2019:1880
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14618 Issue Tracking
- https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf
- https://curl.haxx.se/docs/CVE-2018-14618.html Vendor Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2018-0014 Third Party Advisory
- https://security.gentoo.org/glsa/201903-03 Third Party Advisory
- https://usn.ubuntu.com/3765-1/ Third Party Advisory
- https://usn.ubuntu.com/3765-2/ Third Party Advisory
- https://www.debian.org/security/2018/dsa-4286 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-122Heap-based Buffer Overflow
CWE-131Incorrect Calculation of Buffer Size
CWE-190Integer Overflow
Timeline
Published5 Sep 2018
Updated24 Oct 2026
First seen15 Mar 2026
Sources
CVE-2018-14618 · OSV
CURL-CVE-2018-14618 · OSV
CVE-2018-14618 · NVD
DEBIAN-CVE-2018-14618 · OSV
Track software like this
Free during beta