CVE-2019-17266

What it actually does

Heap-based buffer over-read in soup_ntlm_parse_challenge() caused by missing length validation on NTLM messages before memcpy, allowing out-of-bounds memory access during NTLM authentication handling.

Why it matters to the business

Services using the affected library for HTTP requests with NTLM authentication may crash or leak sensitive memory contents to remote attackers, increasing risk of data exposure or denial of service in applications relying on this component.

How an attack unfolds

An attacker sends a crafted HTTP response containing a malformed NTLM challenge message with an incorrect length field to a target application using libsoup; the vulnerable parsing function performs an unchecked memcpy, resulting in a heap over-read that can disclose memory or cause a crash.

How to fix it

Upgrade libsoup to a version containing commit 88b7dff4467f4151afae244ea7d1223753cd05ab or later; rebuild and redeploy all dependent applications after updating the library.

How to confirm the fix worked

Verify the installed libsoup version is 2.68.1 or newer, or confirm the presence of the fix commit in the source; recompile test binaries against the updated library and exercise NTLM authentication paths with malformed challenges to ensure no over-read occurs.

Typical attack path

1. Identify a target service or application that uses libsoup for outbound HTTP requests involving NTLM authentication.
2. Craft a malicious HTTP response containing an NTLM challenge with a manipulated length field.
3. Deliver the response to trigger soup_ntlm_parse_challenge() during authentication processing.
4. Observe resulting memory disclosure or application crash to confirm successful exploitation.

How to detect it

Monitor application logs for segmentation faults or crashes during NTLM authentication handling; inspect network traffic for NTLM messages with anomalous length fields; review process dumps or memory logs for evidence of out-of-bounds reads triggered by soup-auth-ntlm.c.

What your security team should do

• Prioritize upgrade of libsoup across all builds and containers to the fixed commit version.
• Scan dependency manifests for any remaining versions between 2.65.1 and 2.68.0.
• Add runtime version checks or dependency pinning to prevent reintroduction of vulnerable releases.
• Review NTLM authentication usage and consider migrating to more modern authentication mechanisms where feasible.