Valid HTML 4.01 Transitional Valid CSS Valid SVG 1.0

Me, myself & IT

cURL binary executables for Windows® NT

cURL logo Binary executables of cURL for the I386 alias x86, AMD64 alias x64 and IA64 processor architectures of Microsoft® Windows NT, built with the platform SDK for Windows Server 2003 R2 for use on Windows 2000 and newer versions of Windows NT, using SChannel alias WinSSL and zlib.
X:\> i386\curl.exe -V
curl 7.54.1 (i386-pc-win32) libcurl/7.54.1 WinSSL zlib/1.2.11
Release-Date: 2017-06-14
Protocols: dict file ftp ftps gopher http https imap imaps ldap pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz

X:\> i386\libcurl.exe -V
curl 7.54.1 (i386-pc-win32) libcurl/7.54.1 WinSSL zlib/1.2.11
Release-Date: 2017-06-14
Protocols: dict file ftp ftps gopher http https imap imaps ldap pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz

X:\> amd64\curl.exe -V
curl 7.54.1 (x86_64-pc-win32) libcurl/7.54.1 WinSSL zlib/1.2.11
Release-Date: 2017-06-14
Protocols: dict file ftp ftps gopher http https imap imaps ldap pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz

X:\> amd64\libcurl.exe -V
curl 7.54.1 (x86_64-pc-win32) libcurl/7.54.1 WinSSL zlib/1.2.11
Release-Date: 2017-06-14
Protocols: dict file ftp ftps gopher http https imap imaps ldap pop3 pop3s rtsp smb smbs smtp smtps telnet tftp
Features: AsynchDNS IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL libz

X:\>
Note: unlike other binary executables for Windows they show the official cURL logo as icon, and contain an embedded application manifest to protect against DLL redirection on Windows XP and newer versions of Windows NT as well as DLL spoofing alias DLL preloading, directory poisoning, binary planting, DLL hijacking and DLL side-loading on Windows 7 and newer versions of Windows NT!

Caveat: the statements

There is nothing we can do to prevent against this.
[…]
There is nothing we can do to fix this, it is endemic in the design of Windows.
in cURL's security advisory from May 30, 2016 are outright wrong: the Win32 function SetDefaultDllDirectories(), introduced with the optional update 2533623 as well as the security update MS12-081 alias 2758857 and available in Windows Vista and newer versions of Windows NT since then, controls the DLL search order during runtime.

Code authenticity and integrity

The binary executables CURL.EXE, LIBCURL.EXE and LIBCURL.DLL as well as the cabinet file curl-7.54.1.cab are digitally signed using an X.509 certificate issued by WEB.DE TrustCenter E-Mail Certification Authority.
Serial number
73633199
0x04638DAF
Fingerprint
MD5: 25 a0 d6 b0 bc 37 fe 49 42 d1 64 ca e6 7a f5 7f
SHA-1: 47 79 b5 28 f0 84 e6 ce f8 77 7b 62 dc c4 b3 1f fe de 07 14
-----BEGIN RSA PUBLIC KEY-----
MIIBCgKCAQEAxSwxNrFPXXn6y5Abl+0pH7faIK0xVAh70reOBrwSykab/0kIwz0QJldXNTLl
ZaSb4T7A5il2oqhiHUS53owsguXrDaJ+l+iTuCR/NrOVBJ0Xi+1Kv+ni/jb3cLvTS/BQJtFm
fVW3HHtYrQQcYCpd/AVzg1k2p46BEbGfFpjfFREdM589UDSzaiIOWSEBec8RI3HVqIMiG2qL
seuQot9shOcNcV2Y2AgTKHBUrWz10kbCWf8g5QA2hjmSMRvRtBOovCgvSF0nDFk4Odrn9nLB
PVq763s2vh/riO9cheTeg4N/ldbnAywdjLAwwJ1qynh2p/s/V5cnsoav7SZRGDyAoQIDAQAB
-----END RSA PUBLIC KEY-----
Download and install the CA and root X.509 certificates of WEB.DE to validate and verify the digital signature.

Note: due to its counter signature alias timestamp the digital signature remains valid past the X.509 certificates expiration date!

Download

The binary executables and some text files are packaged in the (compressed and digitally signed) cabinet file curl-7.54.1.cab:
X:\> extract.exe /D curl-7.54.1.cab
Microsoft (R) Cabinet Extraction Tool - Version 5.1.2600.5512
Copyright (c) Microsoft Corporation. All rights reserved..

 Cabinet curl-7.54.1.cab

06-09-2017 11:57:42a A---        69,489 CURL.FAQ
02-21-2017  9:09:14a A---         1,110 CURL.LIC
06-09-2017 11:57:42a A---        41,128 CURL.MAN
06-14-2017  8:10:50a A---        10,568 CURL.REL
11-07-2016 11:18:18a A---         1,659 CURL.TXT
06-14-2017  3:05:06p A---       889,416 AMD64\CURL.EXE
06-14-2017  3:05:06p A---       556,104 AMD64\LIBCURL.DLL
06-14-2017  3:05:06p A---       465,992 AMD64\LIBCURL.EXE
06-14-2017  2:49:40p A---        14,078 AMD64\LIBCURL.LIB
06-14-2017  3:05:06p A---       752,200 I386\CURL.EXE
06-14-2017  3:05:06p A---       473,672 I386\LIBCURL.DLL
06-14-2017  3:05:06p A---       436,808 I386\LIBCURL.EXE
06-14-2017  2:54:58p A---        14,380 I386\LIBCURL.LIB
06-14-2017  3:05:08p A---     1,579,080 IA64\CURL.EXE
06-14-2017  3:05:06p A---     1,144,392 IA64\LIBCURL.DLL
06-14-2017  3:05:08p A---       689,224 IA64\LIBCURL.EXE
06-14-2017  2:43:56p A---        16,644 IA64\LIBCURL.LIB
                17 Files      7,155,944 bytes

X:\> dir curl-7.54.1.cab
 Volume in drive X has no label.
 Volume Serial Number is FEED-BAC3

 Directory of X:\

06/14/2017  03:05 PM         1,438,056 curl-7.54.1.cab
               1 File(s)      1,438,056 bytes
               0 Dir(s)     987,654,321 bytes free

X:\> signtool.exe verify /V curl-7.54.1.cab

Verifying: curl-7-54.1.cab
SHA1 hash of file: (not calculated)
Signing Certificate Chain:
    Issued to: WEB.DE TrustCenter
    Issued by: WEB.DE TrustCenter
    Expires:   30.08.2024 09:49:34
    SHA1 hash: C8301016951187E6320569B3ED54F34845B51638

        Issued to: WEB.DE TrustCenter E-Mail Certification Authority
        Issued by: WEB.DE TrustCenter
        Expires:   30.08.2024 09:50:51
        SHA1 hash: 8946380C6E370988FB587257A9F9A5CD323045F0

            Issued to: Stefan Kanthak
            Issued by: WEB.DE TrustCenter E-Mail Certification Authority
            Expires:   14.09.2017 15:14:26
            SHA1 hash: 4779B528F084E6CEF8777B62DCC4B31FFEDE0714

The signature is timestamped: 14.06.2017 15:05:15
Timestamp Verified by:
    Issued to: Thawte Timestamping CA
    Issued by: Thawte Timestamping CA
    Expires:   01.01.2021 01:59:59
    SHA1 hash: BE36A4562FB2EE05DBB3D32323ADF445084ED656

        Issued to: Symantec Time Stamping Services CA - G2
        Issued by: Thawte Timestamping CA
        Expires:   31.12.2020 01:59:59
        SHA1 hash: 6C07453FFDDA08B83707C09B82FB3D15F35336B1

            Issued to: Symantec Time Stamping Services Signer - G4
            Issued by: Symantec Time Stamping Services CA - G2
            Expires:   30.12.2020 01:59:59
            SHA1 hash: 65439929B67973EB192D6FF243E6767ADF0834E4

Successfully verified: curl-7.54.1.cab

Number of files successfully Verified: 1
Number of warnings: 0
Number of errors: 0

X:\>
Run the command line
"%SystemRoot%\System32\Expand.exe" /R curl-7.54.1.cab /F:* "‹target directory›"
on Windows Vista and newer versions of Windows NT to extract all files into the specified directory, preserving their paths.

Note: Expand.exe from prior versions of Windows NT ignore the paths and junk them; use Extract.exe from the Support Tools on Windows XP and Windows Server 2003 instead!

Note: if you open curl-7.54.1.cab in Windows Explorer switch to Details view and turn on the Path column.

Installation

Download the package curl-7.54.1.cab and verify its digital signature, then open it in Windows Explorer and extract its contents into a directory of your choice.

Note: be sure to select the binary executables that match the processor architecture of your machine (as shown in the Path column of the Details view)!

Deinstallation

Remove the extracted contents.

Contact

If you miss anything here, have additions, comments, corrections, criticism or questions, want to give feedback, hints or tipps, report broken links, bugs, errors, inaccuracies, omissions, vulnerabilities or weaknesses, …:
don't hesitate to contact me and feel free to ask, comment, criticise, flame, notify or report!

Use the X.509 certificate to send S/MIME encrypted mail.

Notes: I dislike HTML (and even weirder formats too) in email, I prefer to receive plain text.
I also expect to see a full (real) name as sender, not a nickname!
Emails in weird formats and without a proper sender name are likely to be discarded.
I abhor top posts and expect inline quotes in replies.

Terms and conditions

By using this site, you signify your agreement to these terms and conditions. If you do not agree to these terms and conditions, do not use this site!
Copyright © 2005-2017 • Stefan Kanthak • <‍skanthak‍@‍nexgo‍.‍de‍>