The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The default configuration for cURL and libcurl before     7.42.1 sends custom HTTP headers to both the proxy and     destination server, which might allow remote proxy     servers to obtain sensitive information by reading the     header contents.(CVE-2015-3153)

  - curl before version 7.51.0 uses outdated IDNA 2003     standard to handle International Domain Names and this     may lead users to potentially and unknowingly issue     network transfer requests to the wrong     host.(CVE-2016-8625)

  - Heap buffer overflow in the TFTP protocol handler in     cURL 7.19.4 to 7.65.3.(CVE-2019-5482)

  - Curl versions 7.14.1 through 7.61.1 are vulnerable to a     heap-based buffer over-read in the tool_msgs.c:voutf()     function that may result in information exposure and     denial of service.(CVE-2018-16842)

  - The ConnectionExists function in lib/url.c in libcurl     before 7.47.0 does not properly re-use     NTLM-authenticated proxy connections, which might allow     remote attackers to authenticate as other users via a     request, a similar issue to     CVE-2014-0015.(CVE-2016-0755)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap buffer overflow in the TFTP receiving code     allows for DoS or arbitrary code execution in libcurl     versions 7.19.4 through 7.64.1.(CVE-2019-5436)

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.(CVE-2017-7407)

  - Curl versions 7.14.1 through 7.61.1 are vulnerable to a     heap-based buffer over-read in the tool_msgs.c:voutf()     function that may result in information exposure and     denial of service.(CVE-2018-16842)

  - The ConnectionExists function in lib/url.c in libcurl     before 7.47.0 does not properly re-use     NTLM-authenticated proxy connections, which might allow     remote attackers to authenticate as other users via a     request, a similar issue to     CVE-2014-0015.(CVE-2016-0755)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the curl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The ConnectionExists function in lib/url.c in libcurl     before 7.47.0 does not properly re-use     NTLM-authenticated proxy connections, which might allow     remote attackers to authenticate as other users via a     request, a similar issue to     CVE-2014-0015.(CVE-2016-0755)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.(CVE-2017-7407)

  - The ConnectionExists function in lib/url.c in libcurl     before 7.47.0 does not properly re-use     NTLM-authenticated proxy connections, which might allow     remote attackers to authenticate as other users via a     request, a similar issue to     CVE-2014-0015.(CVE-2016-0755)

  - Curl versions 7.14.1 through 7.61.1 are vulnerable to a     heap-based buffer over-read in the tool_msgs.c:voutf()     function that may result in information exposure and     denial of service.(CVE-2018-16842)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-47 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers and bug reports referenced for details.
  Impact :

    Remote attackers could conduct a Man-in-the-Middle attack to obtain       sensitive information, cause a Denial of Service condition, or execute       arbitrary code.
  Workaround :

    There is no known workaround at this time.

Versions of cURL and libcurl prior to 7.47.0 are affected by multiple vulnerabilities :

 - A flaw exists that allows traversing outside of a restricted path. The issue is due to the program not properly sanitizing colon characters, specifically path traversal style attacks (e.g. '../') supplied via file names. With a specially crafted file name, a context-dependent attacker can write arbitrary files. (CVE-2016-0754)
 - A flaw exists in the 'ConnectionExists()' function in 'lib/url.c' that is triggered as credentials are not properly compared in proxy NTLM authentication. This may allow a remote attacker to reuse connections. (CVE-2016-0755)

The remote host is running a version of Mac OS X version 10.x prior to 10.12, and is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2016-4694)
 - apache_mod_php (CVE-2016-5768, CVE-2016-5769, CVE-2016-5770, CVE-2016-5771, CVE-2016-5772, CVE-2016-5773, CVE-2016-6174, CVE-2016-6288, CVE-2016-6289, CVE-2016-6290, CVE-2016-6291, CVE-2016-6292, CVE-2016-6294, CVE-2016-6295, CVE-2016-6296, CVE-2016-6297)
 - Apple HSSPI Support (CVE-2016-4697)
 - AppleEFIRuntime (CVE-2016-4696)
 - AppleMobileFileIntegrity (CVE-2016-4698)
 - AppleUUC (CVE-2016-4699, CVE-2016-4700)
 - Application Firewall (CVE-2016-4701)
 - ATS (CVE-2016-4779)
 - Audio (CVE-2016-4702)
 - Bluetooth (CVE-2016-4703)
 - cd9660 (CVE-2016-4706)
 - CFNetwork (CVE-2016-4707, CVE-2016-4708)
 - CommonCrypto (CVE-2016-4711)
 - CoreCrypto (CVE-2016-4712)
 - CoreDisplay (CVE-2016-4713)
 - curl (CVE-2016-0755, CVE-2016-4606)
 - Date & Time Pref Pane (CVE-2016-4715)
 - DiskArbitration (CVE-2016-4716)
 - File Bookmark (CVE-2016-4717)
 - FontParser (CVE-2016-4718)
 - IDS - Connectivity (CVE-2016-4722)
 - Intel Graphics Driver (CVE-2016-4723, CVE-2016-7582)
 - IOAcceleratorFamily (CVE-2016-4724, CVE-2016-4725, CVE-2016-4726)
 - IOThunderboltFamily (CVE-2016-4727)
 - Kerberos v5 PAM module (CVE-2016-4745)
 - Kernel (CVE-2016-4771, CVE-2016-4772, CVE-2016-4773, CVE-2016-4774, CVE-2016-4775, CVE-2016-4776, CVE-2016-4777, CVE-2016-4778)
 - lib archive (CVE-2016-4736)
 - libxml2 (CVE-2016-4658, CVE-2016-5131)
 - libxpc (CVE-2016-4617)
 - libxslt (CVE-2016-4738)
 - mDNSResponder (CVE-2016-4739)
 - NSSecureTextField (CVE-2016-4742)
 - Perl (CVE-2016-4748, CVE-2016-4750)
 - Security (CVE-2016-4752, CVE-2016-4753)
 - Terminal (CVE-2016-4755)
 - WindowServer (CVE-2016-4709, CVE-2016-4710)

The remote host is running a version of Mac OS X that is prior to 10.10.5, 10.11.x prior to 10.11.6, or is not macOS 10.12. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple HSSPI Support
  - AppleEFIRuntime
  - AppleMobileFileIntegrity
  - AppleUCC
  - Application Firewall
  - ATS
  - Audio
  - Bluetooth
  - cd9660
  - CFNetwork
  - CommonCrypto
  - CoreCrypto
  - CoreDisplay
  - curl
  - Date & Time Pref Pane
  - DiskArbitration
  - File Bookmark
  - FontParser
  - IDS - Connectivity
  - ImageIO
  - Intel Graphics Driver
  - IOAcceleratorFamily
  - IOThunderboltFamily
  - Kerberos v5 PAM module
  - Kernel
  - libarchive
  - libxml2
  - libxpc
  - libxslt
  - mDNSResponder
  - NSSecureTextField
  - Perl
  - S2 Camera
  - Security
  - Terminal
  - WindowServer

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Update to 7.47.0 which fixes various CVE's

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- match credentials when re-using a proxy connection     (CVE-2016-0755)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015 . (CVE-2016-0755)

This update for curl fixes the following issues :

  - CVE-2016-0755: libcurl would reuse NTLM-authenticated     proxy connections without properly making sure that the     connection was authenticated with the same credentials     as set for this transfer (bsc#962983)

The following tracked bugs only affect the test suite :

  - bsc#962996: Expired cookie in test 46 caused test     failures

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix a security issue.

This update for curl fixes the following issues :

  - CVE-2016-0755: libcurl would reuse NTLM-authenticated     proxy connections without properly making sure that the     connection was authenticated with the same credentials     as set for this transfer (bsc#962983)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues :

  - CVE-2016-0755: libcurl would reuse NTLM-authenticated     proxy connections without properly making sure that the     connection was authenticated with the same credentials     as set for this transfer (bsc#962983)

The following non-security bugs were fixed :

  - boo#936676: secure_getenv or __secure_getenv may not be     detected correctly at build time

The following tracked bugs only affect the test suite :

  - boo#962996: Expired cookie in test 46 caused test     failures

  - boo#934333: Curl test suite was not run, is now enabled     during build

This update was imported from the SUSE:SLE-12:Update update project.

The cURL project reports :

libcurl will reuse NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer.

Isaac Boukris discovered that curl could incorrectly re-use NTLM proxy credentials when subsequently connecting to the same host.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Isaac Boukris discovered that cURL, an URL transfer library, reused NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for the new transfer. This could lead to HTTP requests being sent over the connection authenticated as a different user.

ID	Name	Product	Family	Severity
131902	EulerOS 2.0 SP2 : curl (EulerOS-SA-2019-2410)	Nessus	Huawei Local Security Checks	critical
129247	EulerOS 2.0 SP3 : curl (EulerOS-SA-2019-2054)	Nessus	Huawei Local Security Checks	critical
126538	EulerOS Virtualization for ARM 64 3.0.2.0 : curl (EulerOS-SA-2019-1696)	Nessus	Huawei Local Security Checks	high
126292	EulerOS 2.0 SP5 : curl (EulerOS-SA-2019-1665)	Nessus	Huawei Local Security Checks	critical
96644	GLSA-201701-47 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
9760	cURL/libcurl 7.x < 7.47.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
9620	Mac OS X 10.x < 10.12 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
93685	macOS < 10.12 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
89551	Fedora 22 : mingw-curl-7.47.0-1.fc22 (2016-5a141de5d9)	Nessus	Fedora Local Security Checks	high
89548	Fedora 23 : curl-7.43.0-5.fc23 (2016-57bebab3b6)	Nessus	Fedora Local Security Checks	high
89546	Fedora 23 : mingw-curl-7.47.0-1.fc23 (2016-55137a3adb)	Nessus	Fedora Local Security Checks	high
89524	Fedora 22 : curl-7.40.0-8.fc22 (2016-3fa315a5dd)	Nessus	Fedora Local Security Checks	high
88664	Amazon Linux AMI : curl (ALAS-2016-652)	Nessus	Amazon Linux Local Security Checks	high
88634	openSUSE Security Update : curl (openSUSE-2016-170)	Nessus	SuSE Local Security Checks	high
88625	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : curl (SSA:2016-039-01)	Nessus	Slackware Local Security Checks	high
88622	SUSE SLED11 / SLES11 Security Update : curl (SUSE-SU-2016:0347-1)	Nessus	SuSE Local Security Checks	high
88621	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2016:0340-1)	Nessus	SuSE Local Security Checks	high
88609	openSUSE Security Update : curl (openSUSE-2016-153)	Nessus	SuSE Local Security Checks	high
88608	openSUSE Security Update : curl (openSUSE-2016-152)	Nessus	SuSE Local Security Checks	high
88476	FreeBSD : curl -- Credentials not checked (8b27f1bc-c509-11e5-a95f-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	high
88457	Ubuntu 14.04 LTS : curl vulnerability (USN-2882-1)	Nessus	Ubuntu Local Security Checks	high
88424	Debian DSA-3455-1 : curl - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-0755

high

Tenable Plugins

critical

critical

high

critical

critical

medium

critical

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high