This script is Copyright (C) 2009-2014 Tenable Network Security, Inc.
The remote Gentoo host is missing one or more security-related
The remote host is affected by the vulnerability described in GLSA-200903-21
(cURL: Arbitrary file access)
David Kierznowski reported that the redirect implementation accepts
arbitrary Location values when CURLOPT_FOLLOWLOCATION is enabled.
A remote attacker could possibly exploit this vulnerability to make
remote HTTP servers trigger arbitrary requests to intranet servers and
read or overwrite arbitrary files via a redirect to a file: URL, or, if
the libssh2 USE flag is enabled, execute arbitrary commands via a
redirect to an scp: URL.
There is no known workaround at this time.
See also :
All cURL users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose '>=net-misc/curl-7.19.4'
Risk factor :
Medium / CVSS Base Score : 6.8
CVSS Temporal Score : 5.6
Public Exploit Available : true