CVE-2022-32208: FTP-KRB bad message verification

Summary

CVE-2022-32208: FTP-KRB bad message verification Project curl Security Advisory, June 27th 2022

VULNERABILITY When curl does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

We are not aware of any exploit of this flaw.

INFO CVE-2022-32208 was introduced in commit 54967d2a3a, shipped in curl 7.16.4.

This flaw typically makes curl insert 599 (+ terminating null) into the data where it detects the error, then the attackers data. It forces the attacker to be somewhat creative to handle this initial hard-coded 5 byte sequence of "junk".

FTP-KRB is a rarely used feature.

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Severity: Low

AFFECTED VERSIONS Affected versions: curl 7.16.4 to and including 7.83.1 Not affected versions: curl < 7.16.4 and curl >= 7.84.0 libcurl is used by many applications, but not always advertised as such!

THE SOLUTION A fix for CVE-2022-32208

RECOMMENDATIONS A - Upgrade curl to version 7.84.0

B - Apply the patch to your local version

C - Do not use KRB-FTP

TIMELINE This issue was reported to the curl project on June 2, 2022. We contacted distros@openwall on June 20.

libcurl 7.84.0 was released on June 27 2022, coordinated with the publication of this advisory.

CREDITS This issue was reported by Harry Sintonen. Patched by Daniel Stenberg.

Thanks a lot!

Security Advisory: https://curl.se/docs/CVE-2022-32208.html