user files a CRITICAL security report against #curl for using strcpy in source code. Proof? Well he did grep the code and it shows that it does indeed use strcpy...
this reminds me of reports of missing spf records for pidgin domains we weren't running email on.. Or the lack of DNSSEC on pidgin.im when .im domains don't support DNSSEC...
I hope he's directly reserved a CVE and already wrote a Medium post about his discovery which he will release in two weeks after the responsible disclosure period.
**Buffer Overflow Exploit Analysis**
The vulnerability in the program is a classic case of a buffer overflow, triggered by the unsafe use of the `strcpy()` function, which lacks bounds checking....
Troed Sångberg
in reply to daniel:// stenberg:// • • •Ben Hardill
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Ben Hardill • • •Gary "grim" Kramlich
in reply to daniel:// stenberg:// • • •ruffy
in reply to daniel:// stenberg:// • • •Aurimas Černius
in reply to daniel:// stenberg:// • • •Janek Bevendorff
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Janek Bevendorff • • •Janek Bevendorff
in reply to daniel:// stenberg:// • • •Julien
in reply to daniel:// stenberg:// • • •Zehka
in reply to daniel:// stenberg:// • • •dtomvan
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to dtomvan • • •yhukeee986
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to daniel:// stenberg:// • • •curl disclosed on HackerOne: Buffer overflow in strcpy
HackerOnedaniel:// stenberg:// reshared this.
Morten Linderud
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Morten Linderud • • •mathieui
in reply to daniel:// stenberg:// • • •Christian Huitema
in reply to daniel:// stenberg:// • • •