The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.
http://curl.haxx.se/docs/adv_20090303.html
http://curl.haxx.se/lxr/source/CHANGES
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html
http://lists.vmware.com/pipermail/security-announce/2009/000060.html
http://secunia.com/advisories/34138
http://secunia.com/advisories/34202
http://secunia.com/advisories/34237
http://secunia.com/advisories/34251
http://secunia.com/advisories/34255
http://secunia.com/advisories/34259
http://secunia.com/advisories/34399
http://secunia.com/advisories/35766
http://security.gentoo.org/glsa/glsa-200903-21.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.476602
http://support.apple.com/kb/HT4077
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0042
http://www.debian.org/security/2009/dsa-1738
http://www.redhat.com/support/errata/RHSA-2009-0341.html
http://www.securityfocus.com/archive/1/501757/100/0/threaded
http://www.securityfocus.com/archive/1/504849/100/0/threaded
http://www.securityfocus.com/bid/33962
http://www.securitytracker.com/id?1021783
http://www.ubuntu.com/usn/USN-726-1
http://www.vmware.com/security/advisories/VMSA-2009-0009.html
http://www.vupen.com/english/advisories/2009/0581
http://www.vupen.com/english/advisories/2009/1865
http://www.withdk.com/2009/03/03/curllibcurl-redirect-arbitrary-file-access/
http://www.withdk.com/archives/Libcurl_arbitrary_file_access.pdf
https://exchange.xforce.ibmcloud.com/vulnerabilities/49030
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11054
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6074
OR
cpe:2.3:a:curl:curl:5.11:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:6.0:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:6.1beta:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:6.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:6.3:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:6.3.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:6.4:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:6.5:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:6.5.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:6.5.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.1.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.2.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.3:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.4:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.5:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.5.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.5.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.6:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.6.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.7:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.7.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.7.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.7.3:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.8:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.8.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.8.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.9:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.9.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.9.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.9.3:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.9.4:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.9.5:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.9.6:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.9.7:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.9.8:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.10:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.10.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.10.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.10.3:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.10.4:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.10.5:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.10.6:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.10.7:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.10.8:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.11.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.12:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.12.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.12.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.13:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.13.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.14:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.14.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.15:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.15.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.15.3:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.16.3:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.16.4:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.17:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.18:*:*:*:*:*:*:*
cpe:2.3:a:curl:curl:7.19.3:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:5.11:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.12:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.12.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.12.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.12.3:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.13:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.13.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.13.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.14:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.14.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.15:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.15.1:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.15.2:*:*:*:*:*:*:*
cpe:2.3:a:curl:libcurl:7.15.3:*:*:*:*:*:*:*
ID | Name | Product | Family | Severity |
---|---|---|---|---|
89115 | VMware ESX Multiple Vulnerabilities (VMSA-2009-0009) (remote check) | Nessus | Misc. | high |
67821 | Oracle Linux 3 / 4 / 5 : curl (ELSA-2009-0341) | Nessus | Oracle Linux Local Security Checks | medium |
60548 | Scientific Linux Security Update : curl on SL3.x, SL4.x, SL5.x i386/x86_64 | Nessus | Scientific Linux Local Security Checks | medium |
58811 | HP System Management Homepage < 7.0 Multiple Vulnerabilities | Nessus | Web Servers | critical |
52011 | VMSA-2009-0009 : ESX Service Console updates for udev, sudo, and curl | Nessus | VMware ESX Local Security Checks | high |
45373 | Mac OS X Multiple Vulnerabilities (Security Update 2010-002) | Nessus | MacOS X Local Security Checks | critical |
41496 | SuSE 10 Security Update : curl (ZYPP Patch Number 6015) | Nessus | SuSE Local Security Checks | medium |
41489 | SuSE 10 Security Update : compat-curl2 (ZYPP Patch Number 6408) | Nessus | SuSE Local Security Checks | high |
41378 | SuSE 11 Security Update : curl (SAT Patch Number 634) | Nessus | SuSE Local Security Checks | medium |
41280 | SuSE9 Security Update : curl (YOU Patch Number 12356) | Nessus | SuSE Local Security Checks | medium |
40208 | openSUSE Security Update : curl (curl-530) | Nessus | SuSE Local Security Checks | medium |
39945 | openSUSE Security Update : curl (curl-530) | Nessus | SuSE Local Security Checks | medium |
37148 | Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : curl vulnerability (USN-726-1) | Nessus | Ubuntu Local Security Checks | medium |
36751 | Mandriva Linux Security Advisory : curl (MDVSA-2009:069) | Nessus | Mandriva Local Security Checks | medium |
36748 | Fedora 10 : curl-7.19.4-1.fc10 (2009-2247) | Nessus | Fedora Local Security Checks | medium |
36478 | Ubuntu 8.10 : curl regression (USN-726-2) | Nessus | Ubuntu Local Security Checks | medium |
35971 | RHEL 2.1 / 3 / 4 / 5 : curl (RHSA-2009:0341) | Nessus | Red Hat Local Security Checks | medium |
35965 | CentOS 3 / 4 : curl (CESA-2009:0341) | Nessus | CentOS Local Security Checks | medium |
35908 | Debian DSA-1738-1 : curl - arbitrary file access | Nessus | Debian Local Security Checks | medium |
35825 | Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 9.1 / current : curl (SSA:2009-069-01) | Nessus | Slackware Local Security Checks | medium |
35819 | GLSA-200903-21 : cURL: Arbitrary file access | Nessus | Gentoo Local Security Checks | medium |
35782 | Fedora 9 : curl-7.19.4-1.fc9 (2009-2265) | Nessus | Fedora Local Security Checks | medium |
35770 | FreeBSD : curl -- cURL/libcURL Location: Redirect URLs Security Bypass (5d433534-f41c-402e-ade5-e0a2259a7cb6) | Nessus | FreeBSD Local Security Checks | medium |
35758 | openSUSE 10 Security Update : curl (curl-6004) | Nessus | SuSE Local Security Checks | medium |