cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VERIFYHOST) when the digital signature verification (CURLOPT_SSL_VERIFYPEER) is disabled, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap use-after-free flaw was found in curl versions     from 7.59.0 through 7.61.1 in the code related to     closing an easy handle. When closing and cleaning up an     'easy' handle in the `Curl_close()` function, the     library code first frees a struct (without nulling the     pointer) and might then subsequently erroneously write     to a struct field within that already freed     struct.(CVE-2018-16840)

  - cURL and libcurl 7.18.0 through 7.32.0, when built with     OpenSSL, disables the certificate CN and SAN name field     verification (CURLOPT_SSL_VERIFYHOST) when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid     certificate.(CVE-2013-4545)

  - The GnuTLS backend in libcurl 7.21.4 through 7.33.0,     when disabling digital signature verification     (CURLOPT_SSL_VERIFYPEER), also disables the     CURLOPT_SSL_VERIFYHOST check for CN or SAN host name     fields, which makes it easier for remote attackers to     spoof servers and conduct man-in-the-middle (MITM)     attacks.(CVE-2013-6422)

  - cURL and libcurl 7.1 before 7.36.0, when using the     OpenSSL, axtls, qsossl or gskit libraries for TLS,     recognize a wildcard IP address in the subject's Common     Name (CN) field of an X.509 certificate, which might     allow man-in-the-middle attackers to spoof arbitrary     SSL servers via a crafted certificate issued by a     legitimate Certification Authority.(CVE-2014-0139)

  - The (1) mbed_connect_step1 function in     lib/vtls/mbedtls.c and (2) polarssl_connect_step1     function in lib/vtls/polarssl.c in cURL and libcurl     before 7.49.0, when using SSLv3 or making a TLS     connection to a URL that uses a numerical IP address,     allow remote attackers to spoof servers via an     arbitrary valid certificate.(CVE-2016-3739)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - cURL and libcurl 7.18.0 through 7.32.0, when built with     OpenSSL, disables the certificate CN and SAN name field     verification (CURLOPT_SSL_VERIFYHOST) when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid     certificate.i1/4^CVE-2013-4545i1/4%0

  - The GnuTLS backend in libcurl 7.21.4 through 7.33.0,     when disabling digital signature verification     (CURLOPT_SSL_VERIFYPEER), also disables the     CURLOPT_SSL_VERIFYHOST check for CN or SAN host name     fields, which makes it easier for remote attackers to     spoof servers and conduct man-in-the-middle (MITM)     attacks.i1/4^CVE-2013-6422i1/4%0

  - cURL and libcurl 7.1 before 7.36.0, when using the     OpenSSL, axtls, qsossl or gskit libraries for TLS,     recognize a wildcard IP address in the subject's Common     Name (CN) field of an X.509 certificate, which might     allow man-in-the-middle attackers to spoof arbitrary     SSL servers via a crafted certificate issued by a     legitimate Certification Authority.i1/4^CVE-2014-0139i1/4%0

  - curl and libcurl 7.27.0 through 7.35.0, when running on     Windows and using the SChannel/Winssl TLS backend, does     not verify that the server hostname matches a domain     name in the subject's Common Name (CN) or     subjectAltName field of the X.509 certificate when     accessing a URL that uses a numerical IP address, which     allows man-in-the-middle attackers to spoof servers via     an arbitrary valid certificate.i1/4^CVE-2014-2522i1/4%0

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.i1/4^CVE-2017-7407i1/4%0

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external     entities.i1/4^CVE-2018-1000007i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Versions of cURL/libcURL older than 7.33.0 are unpatched for a flaw that is due to a file retrieval tool that would disable the 'CURLOPT_SSLVERIFYHOST' check when the 'CURLOPT_SSL_VERIFYPEER' setting was disabled. This may allow a remote attacker to disable SSL certificate host name checks.

This update fixes the following security issues with curl :

  - bnc#849596: ssl cert checks with unclear behaviour     (CVE-2013-4545)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of GlassFish Server running on the remote host is affected by multiple vulnerabilities :

  - A flaw exists in the bundled cURL and libcurl packages.
    The certificate CN and SAN name field verification     (CURLOPT_SSL_VERIFYHOST) is disabled when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled. This allows a man-in-the-middle attacker to     spoof SSL servers via an arbitrary valid certificate.
    (CVE-2013-4545)

  - A flaw exists in the bundled Network Security Services     (NSS) library due to improper parsing of ASN.1 values in     X.509 certificates. This allows a man-in-the-middle     attacker to spoof RSA signatures via a crafted     certificate. (CVE-2014-1568)

  - A man-in-the-middle (MitM) information disclosure     vulnerability known as POODLE. The vulnerability is due     to the way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. MitM attackers can decrypt a     selected byte of a cipher text in as few as 256 tries if     they are able to force a victim application to     repeatedly send the same data over newly created SSL 3.0     connections. (CVE-2014-3566)

The remote Solaris system is missing necessary patches to address security updates :

  - The tailMatch function in cookie.c in cURL and libcurl     before 7.30.0 does not properly match the path domain     when sending cookies, which allows remote attackers to     steal cookies via a matching suffix in the domain of a     URL. (CVE-2013-1944)

  - Heap-based buffer overflow in the curl_easy_unescape     function in lib/escape.c in cURL and libcurl 7.7 through     7.30.0 allows remote attackers to cause a denial of     service (application crash) or possibly execute     arbitrary code via a crafted string ending in a '%'     (percent) character. (CVE-2013-2174)

  - cURL and libcurl 7.18.0 through 7.32.0, when built with     OpenSSL, disables the certificate CN and SAN name field     verification (CURLOPT_SSL_VERIFYHOST) when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid certificate.
    (CVE-2013-4545)

  - cURL and libcurl 7.10.6 through 7.34.0, when more than     one authentication method is enabled, re-uses NTLM     connections, which might allow context-dependent     attackers to authenticate as other users via a request.
    (CVE-2014-0015)

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is affected by the following vulnerabilities :

  - A flaw exists within the included cURL that disables the     'CURLOPT_SSLVERIFYHOST' check when the setting on     'CURLOPT_SSL_VERIFYPEER' is disabled. This can allow a     remote attacker to disable SSL certificate host name     checks. (CVE-2013-4545)

  - A flaw exists in the included PHP 'openssl_x509_parse'     function due to user input not being properly sanitized.
    Using a specially crafted certificate, a remote attacker     can exploit this to cause a denial of service or execute     arbitrary code. (CVE-2013-6420)

  - A flaw exists within the included cURL where the     verification check for the CN and SAN name fields is     skipped due to the digital signature verification being     disabled. A remote attacker can exploit this to spoof     servers or conduct a man-in-the-middle attack.
    (CVE-2013-6422)

  - A flaw exists in the scan function within the included     PHP 'ext/date/lib/parse_iso_intervals.c' script where     user input is not properly sanitized. This can allow a     remote attacker to cause a denial of service using a     heap-based buffer overflow. (CVE-2013-6712)

  - An unspecified cross-site scripting flaw exists which     can allow a remote attacker, using a specially crafted     request, to execute arbitrary code within the     browser / server trust relationship. (CVE-2014-2640)

  - An unspecified cross-site request forgery vulnerability     exists. (CVE-2014-2641)

  - An unspecified vulnerability exists that can allow     a remote attacker to conduct clickjacking attacks.
    (CVE-2014-2642)

This update fixes the following security issues with curl :

  - fix CVE-2013-4545 (bnc#849596) = acknowledge VERIFYHOST     without VERIFYPEER

This update fixes the following security issues with curl :

  - ssl cert checks with unclear behaviour (CVE-2013-4545).
    (bnc#849596)

- Update to 7.33.0

    - Fixes CVE-2013-4545, RHBZ #1031429

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Scott Cantor discovered that libcurl incorrectly verified CN and SAN name fields when digital signature verification was disabled. When libcurl is being used in this uncommon way by specific applications, an attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated curl packages fix security vulnerability :

Scott Cantor discovered that curl, a file retrieval tool, would disable the CURLOPT_SSLVERIFYHOST check when the CURLOPT_SSL_VERIFYPEER setting was disabled. This would also disable ssl certificate host name checks when it should have only disabled verification of the certificate trust chain (CVE-2013-4545).

Scott Cantor discovered that curl, a file retrieval tool, would disable the CURLOPT_SSLVERIFYHOST check when the CURLOPT_SSL_VERIFYPEER setting was disabled. This would also disable ssl certificate host name checks when it should have only disabled verification of the certificate trust chain.

The default configuration for the curl package is not affected by this issue since CURLOPT_SSLVERIFYPEER is enabled by default.

ID	Name	Product	Family	Severity
137468	EulerOS 2.0 SP2 : curl (EulerOS-SA-2020-1626)	Nessus	Huawei Local Security Checks	critical
123858	EulerOS Virtualization 2.5.3 : curl (EulerOS-SA-2019-1172)	Nessus	Huawei Local Security Checks	critical
9979	cURL/libcURL 7.x < 7.33.0 Host Name Validation Bypass	Nessus Network Monitor	Web Clients	low
83606	SUSE SLED11 / SLES11 Security Update : curl (SUSE-SU-2014:0004-1)	Nessus	SuSE Local Security Checks	medium
82902	Oracle GlassFish Server Multiple Vulnerabilities (April 2015 CPU) (POODLE)	Nessus	Web Servers	low
80662	Oracle Solaris Third-Party Patch Update : libcurl (cve_2013_1944_information_disclosure)	Nessus	Solaris Local Security Checks	medium
78090	HP System Management Homepage < 7.4 Multiple Vulnerabilities	Nessus	Web Servers	high
75228	openSUSE Security Update : curl (openSUSE-SU-2013:1859-1)	Nessus	SuSE Local Security Checks	medium
71786	SuSE 11.2 / 11.3 Security Update : curl (SAT Patch Numbers 8617 / 8621)	Nessus	SuSE Local Security Checks	medium
71406	Fedora 20 : mingw-curl-7.33.0-1.fc20 (2013-22046)	Nessus	Fedora Local Security Checks	medium
71244	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 / 13.10 : curl vulnerability (USN-2048-1)	Nessus	Ubuntu Local Security Checks	medium
71151	Fedora 19 : mingw-curl-7.33.0-1.fc19 (2013-21887)	Nessus	Fedora Local Security Checks	medium
71030	Mandriva Linux Security Advisory : curl (MDVSA-2013:276)	Nessus	Mandriva Local Security Checks	medium
70985	Debian DSA-2798-1 : curl - unchecked ssl certificate host name	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-4545

critical

Tenable Plugins

critical

critical

low

medium

low

medium

high

medium

medium

medium

medium

medium

medium

medium