cve/2014/CVE-2014-3707.md

CVE-2014-3707

Description

The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, does not properly copy HTTP POST data for an easy handle, which triggers an out-of-bounds read that allows remote web servers to read sensitive memory information.

POC

Reference

• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
• http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
• http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• https://hackerone.com/reports/104014

Github

• https://github.com/Hwangtaewon/radamsa
• https://github.com/StephenHaruna/RADAMSA
• https://github.com/nqwang/radamsa
• https://github.com/sambacha/mirror-radamsa
• https://github.com/sunzu94/radamsa-Fuzzer