The sanitize_cookie_path function in cURL and libcurl 7.31.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is prior to 7.2.6. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - HP SMH (XSRF)
    - libcurl
    - OpenSSL

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is a version prior to 7.5.4. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists when processing     an ECParameters structure due to an infinite loop that     occurs when a specified curve is over a malformed binary     polynomial field. A remote attacker can exploit this to     perform a denial of service against any system that     processes public keys, certificate requests, or     certificates. This includes TLS clients and TLS servers     with client authentication enabled. (CVE-2015-1788) 

  - A denial of service vulnerability exists due to improper     validation of the content and length of the ASN1_TIME     string by the X509_cmp_time() function. A remote     attacker can exploit this, via a malformed certificate     and CRLs of various sizes, to cause a segmentation     fault, resulting in a denial of service condition. TLS     clients that verify CRLs are affected. TLS clients and     servers with client authentication enabled may be     affected if they use custom verification callbacks.
    (CVE-2015-1789)

  - A NULL pointer dereference flaw exists in the PKCS#7     parsing code due to incorrect handling of missing inner     'EncryptedContent'. This allows a remote attacker, via     specially crafted ASN.1-encoded PKCS#7 blobs with     missing content, to cause a denial of service condition     or other potential unspecified impacts. (CVE-2015-1790)

  - A double-free error exists due to a race condition that     occurs when a NewSessionTicket is received by a     multi-threaded client when attempting to reuse a     previous ticket. (CVE-2015-1791)

  - A denial of service vulnerability exists in the CMS code     due to an infinite loop that occurs when verifying a     signedData message. A remote attacker can exploit this     to cause a denial of service condition. (CVE-2015-1792)

  - A certificate validation bypass vulnerability exists in     the Security:Encryption subcomponent due to a flaw in     the X509_verify_cert() function in x509_vfy.c that is     triggered when locating alternate certificate chains     when the first attempt to build such a chain fails. A     remote attacker can exploit this, by using a valid leaf     certificate as a certificate authority (CA), to issue     invalid certificates that will bypass authentication.
    (CVE-2015-1793)

  - A cross-request authentication bypass vulnerability     exists in libcurl due to the use of an existing,     authenticated connection when performing a subsequent     unauthenticated NTLM HTTP request. An attacker can     exploit this to bypass authentication mechanisms.
    (CVE-2015-3143)

  - A denial of service vulnerability exists in libcurl due     to a flaw in the sanitize_cookie_path() function that is     triggered when handling a cookie path element that     consists of a single double-quote. An attacker can     exploit this to cause the application to crash.
    (CVE-2015-3145)

  - A cross-request authentication bypass vulnerability     exists in libcurl due to a flaw that is triggered when a     request is 'Negotiate' authenticated, which can cause     the program to treat the entire connection as     authenticated rather than just that specific request. An     attacker can exploit this to bypass authentication     mechanisms for subsequent requests. (CVE-2015-3148)

  - A man-in-the-middle vulnerability, known as Logjam,     exists due to a flaw in the SSL/TLS protocol. A remote     attacker can exploit this flaw to downgrade connections     using ephemeral Diffie-Hellman key exchange to 512-bit     export-grade cryptography. (CVE-2015-4000)

  - A flaw exists in the multipart_buffer_headers() function     in rfc1867.c due to improper handling of     multipart/form-data in HTTP requests. A remote attacker     can exploit this flaw to cause a consumption of CPU     resources, resulting in a denial of service condition.
    (CVE-2015-4024)

  - An unspecified flaw exists that allows an authenticated,     remote attacker to impact confidentiality and integrity.
    (CVE-2016-1993)

  - An unspecified information disclosure vulnerability     exists that allows an authenticated, remote attacker to     gain unauthorized access to information. (CVE-2016-1994)

  - An unspecified remote code execution vulnerability     exists that allows an unauthenticated, remote attacker     to take complete control of the system. (CVE-2016-1995)

  - An unspecified flaw exists that allows a local attacker     to impact confidentiality and integrity. (CVE-2016-1996)

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.5. The installed version is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2014-3581, CVE-2014-3583, CVE-2014-8109, CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185)
 - apache_mod_php (CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148)
 - Apple ID OD Plug-in (CVE-2015-3799)
 - AppleGraphicsControl (CVE-2015-5768)
 - Bluetooth (CVE-2015-3777, CVE-2015-3779, CVE-2015-3780, CVE-2015-3786, CVE-2015-3787)
 - bootp (CVE-2015-3778)
 - CloudKit (CVE-2015-3782)
 - CoreMedia Playback (CVE-2015-5777, CVE-2015-5778)
 - CoreText (CVE-2015-5761, CVE-2015-5755)
 - curl (CVE-2014-3613, CVE-2014-3620, CVE-2014-3707, CVE-2014-8150, CVE-2014-8151, CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153)
 - Data Detectors Engine (CVE-2015-5750)
 - Date & Time pref pane (CVE-2015-3757)
 - Dictionary Application (CVE-2015-3774)
 - DiskImages (CVE-2015-3800)
 - dyld (CVE-2015-3760)
 - FontParser (CVE-2015-3804, CVE-2015-5775, CVE-2015-5756)
 - groff (CVE-2009-5044, CVE-2009-5078)
 - ImageIO (CVE-2015-5758, CVE-2015-5781, CVE-2015-5782)
 - Install Framework Legacy (CVE-2015-5784, CVE-2015-5754)
 - IOFireWireFamily (CVE-2015-3769, CVE-2015-3771, CVE-2015-3772)
 - IOGraphics (CVE-2015-3770, CVE-2015-5783)
 - IOHIDFamily (CVE-2015-5774)
 - Kernel (CVE-2015-3766, CVE-2015-3768, CVE-2015-5747, CVE-2015-5748, CVE-2015-3806, CVE-2015-3803, CVE-2015-3802, CVE-2015-3805, CVE-2015-3776, CVE-2015-3761)
 - Libc (CVE-2015-3796, CVE-2015-3797, CVE-2015-3798)
 - Libinfo (CVE-2015-5776)
 - libpthread (CVE-2015-5757)
 - libxml2 (CVE-2014-0191, CVE-2014-3660, CVE-2015-3807)
 - libxpc (CVE-2015-3795)
 - mail_cmds (CVE-2014-7844)
 - Notification Center OSX (CVE-2015-3764)
 - ntfs (CVE-2015-5763)
 - OpenSSH (CVE-2015-5600)
 - OpenSSL (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)
 - perl (CVE-2013-7422)
 - PostgreSQL (CVE-2014-0067, CVE-2014-8161, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244)
 - python (CVE-2013-7040, CVE-2013-7338, CVE-2014-1912, CVE-2014-7185, CVE-2014-9365)
 - QL Office (CVE-2015-5773, CVE-2015-3784)
 - Quartz Composer Framework (CVE-2015-5771)
 - Quick Look (CVE-2015-3781)
 - QuickTime 7 (CVE-2015-3779, CVE-2015-5753, CVE-2015-5779, CVE-2015-3765, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751)
 - SceneKit (CVE-2015-5772, CVE-2015-3783)
 - Security (CVE-2015-3775)
 - SMBClient (CVE-2015-3773)
 - Speech UI (CVE-2015-3794)
 - sudo (CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2014-0106, CVE-2014-9680)
 - tcpdump (CVE-2014-8767, CVE-2014-8769, CVE-2014-9140)
 - Text Formats (CVE-2015-3762)
 - udf (CVE-2015-3767)

 Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is affected by the vulnerability described in GLSA-201509-02 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly obtain sensitive information, or cause       a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

cURL and libcurl before 7.42.0 are unpatched for the following vulnerabilities: 

 - A flaw may be triggered when an application reuses an authenticated connection and performs a subsequent unauthenticated NTLM HTTP request allowing an attacker to bypass authentication mechanisms. (CVE-2015-3143) 
 - An off-by-one flaw in the 'fix_hostname()' function that is triggered when handling a zero-length hostname allowing an attacker to cause a program linked against the library to crash. (CVE-2015-3144) 
 -  A flaw in the 'sanitize_cookie_path()' function is triggered when handling a cookie path element that consists of a single double-quote allowing an attacker to destroy heap memory and potentially cause a program linked against the library to crash. (CVE-2015-3145) 
 - A flaw may be triggered when a request is Negotiate authenticated, which can cause the program to treat the entire connection as authenticated rather than just that specific request allowing an attacker to bypass authentication mechanisms for subsequent requests. (CVE-2015-3148)

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

curl was updated to fix five security issues.

The following vulnerabilities were fixed :

  - CVE-2015-3143: curl could re-use NTML authenticateds     connections

  - CVE-2015-3144: curl could access memory out of bounds     with zero length host names

  - CVE-2015-3145: curl cookie parser could access memory     out of boundary

  - CVE-2015-3148: curl could treat Negotiate as not     connection-oriented

  - CVE-2015-3153: curl could have sent sensitive HTTP     headers also to proxies

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated curl packages fix security vulnerabilities :

NTLM-authenticated connections could be wrongly reused for requests without any credentials set, leading to HTTP requests being sent over the connection authenticated as a different user (CVE-2015-3143).

When parsing HTTP cookies, if the parsed cookie's path element consists of a single double-quote, libcurl would try to write to an invalid heap memory address. This could allow remote attackers to cause a denial of service (crash) (CVE-2015-3145).

When doing HTTP requests using the Negotiate authentication method along with NTLM, the connection used would not be marked as authenticated, making it possible to reuse it and send requests for one user over the connection authenticated as a different user (CVE-2015-3148).

Update to 7.42.0 which fixes various CVE's

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- require credentials to match for NTLM re-use     (CVE-2015-3143)

    - fix invalid write with a zero-length host name in URL       (CVE-2015-3144)

    - fix invalid write in cookie path sanitization code       (CVE-2015-3145)

    - close Negotiate connections when done (CVE-2015-3148)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Paras Sethia discovered that curl could incorrectly re-use NTLM HTTP credentials when subsequently connecting to the same host over HTTP.
(CVE-2015-3143)

Hanno Bock discovered that curl incorrectly handled zero-length host names. If a user or automated system were tricked into using a specially crafted host name, an attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3144)

Hanno Bock discovered that curl incorrectly handled cookie path elements. If a user or automated system were tricked into parsing a specially crafted cookie, an attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3145)

Isaac Boukris discovered that when using Negotiate authenticated connections, curl could incorrectly authenticate the entire connection and not just specific HTTP requests. (CVE-2015-3148)

Yehezkel Horowitz and Oren Souroujon discovered that curl sent HTTP headers both to servers and proxies by default, contrary to expectations. This issue only affected Ubuntu 14.10 and Ubuntu 15.04.
(CVE-2015-3153).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

curl was updated to fix four security issues.

The following vulnerabilities were fixed :

  - CVE-2015-3143: curl could re-use NTML authenticateds     connections

  - CVE-2015-3144: curl could access memory out of bounds     with zero length host names

  - CVE-2015-3145: curl cookie parser could access memory     out of boundary

  - CVE-2015-3148: curl could treat Negotiate as not     connection-oriented

- require credentials to match for NTLM re-use     (CVE-2015-3143)

    - fix invalid write in cookie path sanitization code       (CVE-2015-3145)

    - close Negotiate connections when done (CVE-2015-3148)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libcurl could incorrectly reuse NTLM-authenticated connections for subsequent unauthenticated requests to the same host. If an application using libcurl established an NTLM-authenticated connection to a server, and sent subsequent unauthenticed requests to the same server, the unauthenticated requests could be sent over the NTLM-authenticated connection, appearing as if they were sent by the NTLM authenticated user.
(CVE-2015-3143)

It was discovered that libcurl could incorrectly reuse Negotiate authenticated HTTP connections for subsequent requests. If an application using libcurl established a Negotiate authenticated HTTP connection to a server and sent subsequent requests with different credentials, the connection could be re-used with the initial set of credentials instead of using the new ones. (CVE-2015-3148)

It was discovered that libcurl did not properly process cookies with a specially crafted 'path' element. If an application using libcurl connected to a malicious HTTP server sending specially crafted 'Set-Cookies' headers, this could lead to an out-of-bounds read, and possibly cause that application to crash. (CVE-2015-3145)

It was discovered that libcurl did not properly process zero-length host names. If an attacker could trick an application using libcurl into processing zero-length host names, this could lead to an out-of-bounds read, and possibly cause that application to crash.
(CVE-2015-3144)

Several vulnerabilities were discovered in cURL, an URL transfer library :

  - CVE-2015-3143     NTLM-authenticated connections could be wrongly reused     for requests without any credentials set, leading to     HTTP requests being sent over the connection     authenticated as a different user. This is similar to     the issue fixed in DSA-2849-1.

  - CVE-2015-3144     When parsing URLs with a zero-length hostname (such as     'http://:80'), libcurl would try to read from an invalid     memory address. This could allow remote attackers to     cause a denial of service (crash). This issue only     affects the upcoming stable (jessie) and unstable (sid)     distributions.

  - CVE-2015-3145     When parsing HTTP cookies, if the parsed cookie's 'path'     element consists of a single double-quote, libcurl would     try to write to an invalid heap memory address. This     could allow remote attackers to cause a denial of     service (crash). This issue only affects the upcoming     stable (jessie) and unstable (sid) distributions.

  - CVE-2015-3148     When doing HTTP requests using the Negotiate     authentication method along with NTLM, the connection     used would not be marked as authenticated, making it     possible to reuse it and send requests for one user over     the connection authenticated as a different user.

ID	Name	Product	Family	Severity
90251	HP System Management Homepage < 7.2.6 Multiple Vulnerabilities (FREAK)	Nessus	Web Servers	high
90150	HP System Management Homepage < 7.5.4 Multiple Vulnerabilities (Logjam)	Nessus	Web Servers	critical
86662	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : curl (SSA:2015-302-01)	Nessus	Slackware Local Security Checks	high
8981	Mac OS X < 10.10.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
86133	GLSA-201509-02 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
8863	cURL / libcURL 7.x < 7.42.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
83988	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2015:0990-1)	Nessus	SuSE Local Security Checks	high
83243	Mandriva Linux Security Advisory : curl (MDVSA-2015:219)	Nessus	Mandriva Local Security Checks	high
83237	Fedora 21 : mingw-curl-7.42.0-1.fc21 (2015-6853)	Nessus	Fedora Local Security Checks	high
83212	Fedora 22 : mingw-curl-7.42.0-1.fc22 (2015-6864)	Nessus	Fedora Local Security Checks	high
83208	Fedora 21 : curl-7.37.0-14.fc21 (2015-6728)	Nessus	Fedora Local Security Checks	high
83182	Ubuntu 14.04 LTS : curl vulnerabilities (USN-2591-1)	Nessus	Ubuntu Local Security Checks	critical
83159	openSUSE Security Update : curl (openSUSE-2015-336)	Nessus	SuSE Local Security Checks	high
83128	Fedora 20 : curl-7.32.0-20.fc20 (2015-6712)	Nessus	Fedora Local Security Checks	high
83078	Fedora 22 : curl-7.40.0-3.fc22 (2015-6695)	Nessus	Fedora Local Security Checks	high
83057	Amazon Linux AMI : curl (ALAS-2015-514)	Nessus	Amazon Linux Local Security Checks	high
83003	Debian DSA-3232-1 : curl - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-3145

high

Tenable Plugins

high

critical

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

high