CVE-2009-0037

MEDIUM

Description

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

References

http://curl.haxx.se/docs/adv_20090303.html

http://curl.haxx.se/lxr/source/CHANGES

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html

http://lists.vmware.com/pipermail/security-announce/2009/000060.html

http://secunia.com/advisories/34138

http://secunia.com/advisories/34202

http://secunia.com/advisories/34237

http://secunia.com/advisories/34251

http://secunia.com/advisories/34255

http://secunia.com/advisories/34259

http://secunia.com/advisories/34399

http://secunia.com/advisories/35766

http://security.gentoo.org/glsa/glsa-200903-21.xml

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.476602

http://support.apple.com/kb/HT4077

http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0042

http://www.debian.org/security/2009/dsa-1738

http://www.redhat.com/support/errata/RHSA-2009-0341.html

http://www.securityfocus.com/archive/1/501757/100/0/threaded

http://www.securityfocus.com/archive/1/504849/100/0/threaded

http://www.securityfocus.com/bid/33962

http://www.securitytracker.com/id?1021783

http://www.ubuntu.com/usn/USN-726-1

http://www.vmware.com/security/advisories/VMSA-2009-0009.html

http://www.vupen.com/english/advisories/2009/0581

http://www.vupen.com/english/advisories/2009/1865

http://www.withdk.com/2009/03/03/curllibcurl-redirect-arbitrary-file-access/

http://www.withdk.com/archives/Libcurl_arbitrary_file_access.pdf

https://exchange.xforce.ibmcloud.com/vulnerabilities/49030

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11054

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6074

Details

Source: MITRE

Published: 2009-03-05

Updated: 2018-10-11

Type: CWE-352

Risk Information

CVSS v2.0

Base Score: 6.8

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 8.6

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:curl:curl:5.11:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:6.0:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:6.1beta:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:6.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:6.3:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:6.3.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:6.4:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:6.5:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:6.5.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:6.5.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.1.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.2.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.3:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.4:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.4.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.4.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.5:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.5.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.5.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.6:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.6.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.7:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.7.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.7.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.7.3:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.8:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.8.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.8.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.9:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.9.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.9.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.9.3:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.9.4:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.9.5:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.9.6:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.9.7:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.9.8:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.10:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.10.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.10.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.10.3:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.10.4:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.10.5:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.10.6:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.10.7:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.10.8:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.11.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.12:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.12.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.12.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.13:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.13.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.14:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.14.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.15:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.15.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.15.3:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.16.3:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.16.4:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.17:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.18:*:*:*:*:*:*:*

cpe:2.3:a:curl:curl:7.19.3:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:5.11:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.12:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.12.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.12.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.12.3:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.13:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.13.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.13.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.14:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.14.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.15:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.15.1:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.15.2:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.15.3:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.16.3:*:*:*:*:*:*:*

cpe:2.3:a:curl:libcurl:7.19.3:*:*:*:*:*:*:*

Tenable Plugins

View all (24 total)

IDNameProductFamilySeverity
89115VMware ESX Multiple Vulnerabilities (VMSA-2009-0009) (remote check)NessusMisc.
high
67821Oracle Linux 3 / 4 / 5 : curl (ELSA-2009-0341)NessusOracle Linux Local Security Checks
medium
60548Scientific Linux Security Update : curl on SL3.x, SL4.x, SL5.x i386/x86_64NessusScientific Linux Local Security Checks
medium
58811HP System Management Homepage < 7.0 Multiple VulnerabilitiesNessusWeb Servers
critical
52011VMSA-2009-0009 : ESX Service Console updates for udev, sudo, and curlNessusVMware ESX Local Security Checks
high
45373Mac OS X Multiple Vulnerabilities (Security Update 2010-002)NessusMacOS X Local Security Checks
critical
41496SuSE 10 Security Update : curl (ZYPP Patch Number 6015)NessusSuSE Local Security Checks
medium
41489SuSE 10 Security Update : compat-curl2 (ZYPP Patch Number 6408)NessusSuSE Local Security Checks
high
41378SuSE 11 Security Update : curl (SAT Patch Number 634)NessusSuSE Local Security Checks
medium
41280SuSE9 Security Update : curl (YOU Patch Number 12356)NessusSuSE Local Security Checks
medium
40208openSUSE Security Update : curl (curl-530)NessusSuSE Local Security Checks
medium
39945openSUSE Security Update : curl (curl-530)NessusSuSE Local Security Checks
medium
37148Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : curl vulnerability (USN-726-1)NessusUbuntu Local Security Checks
medium
36751Mandriva Linux Security Advisory : curl (MDVSA-2009:069)NessusMandriva Local Security Checks
medium
36748Fedora 10 : curl-7.19.4-1.fc10 (2009-2247)NessusFedora Local Security Checks
medium
36478Ubuntu 8.10 : curl regression (USN-726-2)NessusUbuntu Local Security Checks
medium
35971RHEL 2.1 / 3 / 4 / 5 : curl (RHSA-2009:0341)NessusRed Hat Local Security Checks
medium
35965CentOS 3 / 4 : curl (CESA-2009:0341)NessusCentOS Local Security Checks
medium
35908Debian DSA-1738-1 : curl - arbitrary file accessNessusDebian Local Security Checks
medium
35825Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 9.1 / current : curl (SSA:2009-069-01)NessusSlackware Local Security Checks
medium
35819GLSA-200903-21 : cURL: Arbitrary file accessNessusGentoo Local Security Checks
medium
35782Fedora 9 : curl-7.19.4-1.fc9 (2009-2265)NessusFedora Local Security Checks
medium
35770FreeBSD : curl -- cURL/libcURL Location: Redirect URLs Security Bypass (5d433534-f41c-402e-ade5-e0a2259a7cb6)NessusFreeBSD Local Security Checks
medium
35758openSUSE 10 Security Update : curl (curl-6004)NessusSuSE Local Security Checks
medium