To avoid this issue, it is recommended NOT to use `CURLPROXY_SOCKS5_HOSTNAME` proxies with cURL. Also, do not set a proxy environment variable to socks5h://

In summary, an overflow is only possible in applications that do not set CURLOPT_BUFFERSIZE, or set it smaller than approximately 65kB. Since the cURL tool sets CURLOPT_BUFFERSIZE to 100kB by default, it is not vulnerable unless rate limiting was set by the user to a size smaller than 65KB.

The vulnerability is only triggered in very specific conditions when all four conditions below are met:

• The request is made via socks5h.
• The state machine's negotiation buffer is smaller than ~65k.
• The SOCKS server's "hello" reply is delayed.
• The attacker sets a final destination hostname larger than the negotiation buffer.

This makes the said vulnerability very difficult to exploit.

The Agent package contains its own cURL shared library file and does not use system one. cURL is used to check the connection between Deep Security Agent and Deep Security Manager as well as download security updates from the Trend Micro ActiveUpdate server. Since the vulnerability has no impact on the product, upgrading the cURL version is not in the roadmap.

It is important to note that even though a penetration scanner could flag the cURL-related CVEs, it doesn't mean that the Deep Security Agent is vulnerable to the said CVE.