The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

The remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists in sudo in file parse.c due to a failure     to properly interpret a system group (%group) in the     sudoers configuration file when handling authorization     decisions for users belonging to that group. A local     attacker can exploit this to gain root privileges via a     crafted sudo command. (CVE-2009-0034)

  - A flaw exists in the redirect implementation in libcurl     that allows arbitrary Location values to be accepted     when CURLOPT_FOLLOWLOCATION is enabled. An attacker     with control of a remote HTTP server can exploit this,     via crafted redirect URLs, to trigger requests to     intranet servers, to read or write arbitrary files, or     to execute arbitrary commands. (CVE-2009-0037)

  - A flaw exists in udev due to a failure to verify that a     NETLINK message originates from the kernel space. A     local attacker can exploit this, via a crafted NETLINK     message, to gain elevated privileges on the root file     system. (CVE-2009-1185)

From Red Hat Security Advisory 2009:0341 :

Updated curl packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity.

David Kierznowski discovered a flaw in libcurl where it would not differentiate between different target URLs when handling automatic redirects. This caused libcurl to follow any new URL that it understood, including the 'file://' URL type. This could allow a remote server to force a local libcurl-using application to read a local file instead of the remote one, possibly exposing local files that were not meant to be exposed. (CVE-2009-0037)

Note: Applications using libcurl that are expected to follow redirects to 'file://' protocol must now explicitly call curl_easy_setopt(3) and set the newly introduced CURLOPT_REDIR_PROTOCOLS option as required.

cURL users should upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using libcurl must be restarted for the update to take effect.

David Kierznowski discovered a flaw in libcurl where it would not differentiate between different target URLs when handling automatic redirects. This caused libcurl to follow any new URL that it understood, including the 'file://' URL type. This could allow a remote server to force a local libcurl-using application to read a local file instead of the remote one, possibly exposing local files that were not meant to be exposed. (CVE-2009-0037)

Note: Applications using libcurl that are expected to follow redirects to 'file://' protocol must now explicitly call curl_easy_setopt(3) and set the newly introduced CURLOPT_REDIR_PROTOCOLS option as required.

All running applications using libcurl must be restarted for the update to take effect.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote host is earlier than 7.0.  As such, it is reportedly affected by the following vulnerabilities :

 - An error exists in the 'generate-id' function in the    bundled libxslt library that can allow disclosure of    heap memory addresses. (CVE-2011-0195)

 - An unspecified input validation error exists and can    allow cross-site request forgery attacks. (CVE-2011-3846)

 - Unspecified errors can allow attackers to carry out    denial of service attacks via unspecified vectors.
   (CVE-2012-0135, CVE-2012-1993)

 - The bundled version of PHP contains multiple    vulnerabilities. (CVE-2010-3436, CVE-2010-4409,    CVE-2010-4645, CVE-2011-1148, CVE-2011-1153,    CVE-2011-1464, CVE-2011-1467, CVE-2011-1468,    CVE-2011-1470, CVE-2011-1471, CVE-2011-1938,    CVE-2011-2202, CVE-2011-2483, CVE-2011-3182,    CVE-2011-3189, CVE-2011-3267, CVE-2011-3268)

 - The bundled version of Apache contains multiple    vulnerabilities. (CVE-2010-1452, CVE-2010-1623,    CVE-2010-2068,  CVE-2010-2791, CVE-2011-0419,    CVE-2011-1928, CVE-2011-3192, CVE-2011-3348,    CVE-2011-3368, CVE-2011-3639)

 - OpenSSL libraries are contained in several of the    bundled components and contain multiple vulnerabilities.
   (CVE-2011-0014, CVE-2011-1468, CVE-2011-1945,    CVE-2011-3207,CVE-2011-3210)

 - Curl libraries are contained in several of the bundled    components and contain multiple vulnerabilities.
   (CVE-2009-0037, CVE-2010-0734, CVE-2011-2192)

a. Service Console package udev

   A vulnerability in the udev program did not verify whether a NETLINK    message originates from kernel space, which allows local users to    gain privileges by sending a NETLINK message from user space.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-1185 to this issue.

   Please see http://kb.vmware.com/kb/1011786 for details.

b. Service Console package sudo

   Service Console package for sudo has been updated to version    sudo-1.6.9p17-3. This fixes the following issue: Sudo versions    1.6.9p17 through 1.6.9p19 do not properly interpret a system group    in the sudoers file during authorization decisions for a user who    belongs to that group, which might allow local users to leverage an    applicable sudoers file and gain root privileges by using a sudo    command.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0034 to this issue.

   Please see http://kb.vmware.com/kb/1011781 for more details

c. Service Console package curl

   Service Console package for curl has been updated to version    curl-7.15.5-2.1.  This fixes the following issue: The redirect    implementation in curl and libcurl 5.11 through 7.19.3, when    CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location    values, which might allow remote HTTP servers to trigger arbitrary    requests to intranet servers, read or overwrite arbitrary files by    using a redirect to a file: URL, or execute arbitrary commands by    using a redirect to an scp: URL.

   The Common Vulnerabilities and Exposures Project (cve.mitre.org)    has assigned the name CVE-2009-0037 to this issue.

   Please see http://kb.vmware.com/kb/1011782 for details

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

Arbitrary file access via HTTP-redirect has been fixed in curl.
CVE-2009-0037 has been assigned to this issue.

This update of libcurl2 fixes the 0-character handling in the subject name of a SSL certificate. This bug could be used to execute an undetected man-in-the-middle-attack. (CVE-2009-2417) Additionally the arbitrary file access problem was fixed. (CVE-2009-0037)

It was discovered that curl did not enforce any restrictions when following URL redirects. If a user or automated system were tricked into opening a URL to an untrusted server, an attacker could use redirects to gain access to arbitrary files. This update changes curl behavior to prevent following 'file' URLs after a redirect.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A security vulnerability has been identified and fixed in curl, which could allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL (CVE-2009-0037).

The updated packages have been patched to prevent this.

Update to curl-7.19.4 fixes CVE-2009-0037.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

USN-726-1 fixed a vulnerability in curl. Due to an incomplete fix, a regression was introduced in Ubuntu 8.10 that caused certain types of URLs to fail. This update fixes the problem. We apologize for the inconvenience.

It was discovered that curl did not enforce any restrictions when following URL redirects. If a user or automated system were tricked into opening a URL to an untrusted server, an attacker could use redirects to gain access to arbitrary files. This update changes curl behavior to prevent following 'file' URLs after a redirect.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated curl packages that fix a security issue are now available for Red Hat Enterprise Linux 2.1, 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity.

David Kierznowski discovered a flaw in libcurl where it would not differentiate between different target URLs when handling automatic redirects. This caused libcurl to follow any new URL that it understood, including the 'file://' URL type. This could allow a remote server to force a local libcurl-using application to read a local file instead of the remote one, possibly exposing local files that were not meant to be exposed. (CVE-2009-0037)

Note: Applications using libcurl that are expected to follow redirects to 'file://' protocol must now explicitly call curl_easy_setopt(3) and set the newly introduced CURLOPT_REDIR_PROTOCOLS option as required.

cURL users should upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using libcurl must be restarted for the update to take effect.

David Kierznowski discovered that libcurl, a multi-protocol file transfer library, when configured to follow URL redirects automatically, does not question the new target location. As libcurl also supports file:// and scp:// URLs - depending on the setup - an untrusted server could use that to expose local files, overwrite local files or even execute arbitrary code via a malicious URL redirect.

This update introduces a new option called CURLOPT_REDIR_PROTOCOLS which by default does not include the scp and file protocol handlers.

New curl packages are available for Slackware 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix a security issue.

The remote host is affected by the vulnerability described in GLSA-200903-21 (cURL: Arbitrary file access)

    David Kierznowski reported that the redirect implementation accepts     arbitrary Location values when CURLOPT_FOLLOWLOCATION is enabled.
  Impact :

    A remote attacker could possibly exploit this vulnerability to make     remote HTTP servers trigger arbitrary requests to intranet servers and     read or overwrite arbitrary files via a redirect to a file: URL, or, if     the libssh2 USE flag is enabled, execute arbitrary commands via a     redirect to an scp: URL.
  Workaround :

    There is no known workaround at this time.

Secunia reports :

The security issue is caused due to cURL following HTTP Location :
redirects to e.g. scp:// or file:// URLs which can be exploited by a malicious HTTP server to overwrite or disclose the content of arbitrary local files and potentially execute arbitrary commands via specially crafted redirect URLs.

ID	Name	Product	Family	Severity
89115	VMware ESX Multiple Vulnerabilities (VMSA-2009-0009) (remote check)	Nessus	Misc.	high
67821	Oracle Linux 3 / 4 / 5 : curl (ELSA-2009-0341)	Nessus	Oracle Linux Local Security Checks	medium
60548	Scientific Linux Security Update : curl on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58811	HP System Management Homepage < 7.0 Multiple Vulnerabilities	Nessus	Web Servers	critical
52011	VMSA-2009-0009 : ESX Service Console updates for udev, sudo, and curl	Nessus	VMware ESX Local Security Checks	high
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	critical
41496	SuSE 10 Security Update : curl (ZYPP Patch Number 6015)	Nessus	SuSE Local Security Checks	medium
41489	SuSE 10 Security Update : compat-curl2 (ZYPP Patch Number 6408)	Nessus	SuSE Local Security Checks	high
41378	SuSE 11 Security Update : curl (SAT Patch Number 634)	Nessus	SuSE Local Security Checks	medium
41280	SuSE9 Security Update : curl (YOU Patch Number 12356)	Nessus	SuSE Local Security Checks	medium
40208	openSUSE Security Update : curl (curl-530)	Nessus	SuSE Local Security Checks	medium
39945	openSUSE Security Update : curl (curl-530)	Nessus	SuSE Local Security Checks	medium
37148	Ubuntu 6.06 LTS / 7.10 / 8.04 LTS / 8.10 : curl vulnerability (USN-726-1)	Nessus	Ubuntu Local Security Checks	medium
36751	Mandriva Linux Security Advisory : curl (MDVSA-2009:069)	Nessus	Mandriva Local Security Checks	medium
36748	Fedora 10 : curl-7.19.4-1.fc10 (2009-2247)	Nessus	Fedora Local Security Checks	medium
36478	Ubuntu 8.10 : curl regression (USN-726-2)	Nessus	Ubuntu Local Security Checks	medium
35971	RHEL 2.1 / 3 / 4 / 5 : curl (RHSA-2009:0341)	Nessus	Red Hat Local Security Checks	medium
35965	CentOS 3 / 4 : curl (CESA-2009:0341)	Nessus	CentOS Local Security Checks	medium
35908	Debian DSA-1738-1 : curl - arbitrary file access	Nessus	Debian Local Security Checks	medium
35825	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 9.1 / current : curl (SSA:2009-069-01)	Nessus	Slackware Local Security Checks	medium
35819	GLSA-200903-21 : cURL: Arbitrary file access	Nessus	Gentoo Local Security Checks	medium
35782	Fedora 9 : curl-7.19.4-1.fc9 (2009-2265)	Nessus	Fedora Local Security Checks	medium
35770	FreeBSD : curl -- cURL/libcURL Location: Redirect URLs Security Bypass (5d433534-f41c-402e-ade5-e0a2259a7cb6)	Nessus	FreeBSD Local Security Checks	medium
35758	openSUSE 10 Security Update : curl (curl-6004)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2009-0037

critical

Tenable Plugins

high

medium

medium

critical

high

critical

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium