curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8623)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8622)

  - It was found that the libcurl library did not prevent     TLS session resumption when the client certificate had     changed. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate.(CVE-2016-5419)

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker     could exploit this flaw to potentially cause     information disclosure or crash the     application.(CVE-2017-1000257)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8624)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8621)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage(CVE-2018-1000122)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-9586)

  - The FTP wildcard function in curl and libcurl before     7.57.0 allows remote attackers to cause a denial of     service (out-of-bounds read and application crash) or     possibly have unspecified other impact via a string     that ends with an '' character.(CVE-2017-8817)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8618)

  - It was found that the libcurl library using the NSS     (Network Security Services) library as TLS/SSL backend     incorrectly re-used client certificates for subsequent     TLS connections in certain cases. An attacker could     potentially use this flaw to hijack the authentication     of the connection by leveraging a previously created     connection with a different client     certificate.(CVE-2016-7141)

  - cURL and libcurl 7.10.6 through 7.34.0, when more than     one authentication method is enabled, re-uses NTLM     connections, which might allow context-dependent     attackers to authenticate as other users via a     request.(CVE-2014-0015)

  - The tailMatch function in cookie.c in cURL and libcurl     before 7.30.0 does not properly match the path domain     when sending cookies, which allows remote attackers to     steal cookies via a matching suffix in the domain of a     URL.(CVE-2013-1944)

  - It was discovered that the libcurl library failed to     properly handle URLs with embedded end-of-line     characters. An attacker able to make an application     using libcurl access a specially crafted URL via an     HTTP proxy could use this flaw to inject additional     headers to the request or construct additional     requests.(CVE-2014-8150)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8615)

  - The default configuration in cURL and libcurl 7.10.6     before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4)     POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9)     LDAP, and (10) LDAPS connections, which might allow     context-dependent attackers to connect as other users     via a request, a similar issue to     CVE-2014-0015.(CVE-2014-0138)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8617)

  - It was found that the libcurl library did not correctly     handle partial literal IP addresses when parsing     received HTTP cookies. An attacker able to trick a user     into connecting to a malicious server could use this     flaw to set the user's cookie to a crafted domain,     making other cookie-related issues easier to     exploit.(CVE-2014-3613)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in cURL, an URL transfer library.

CVE-2016-7141

When built with NSS and the libnsspem.so library is available at runtime, allows an remote attacker to hijack the authentication of a TLS connection by leveraging reuse of a previously loaded client certificate from file for a connection for which no certificate has been set, a different vulnerability than CVE-2016-5420.

CVE-2016-7167

Multiple integer overflows in the (1) curl_escape, (2) curl_easy_escape, (3) curl_unescape, and (4) curl_easy_unescape functions in libcurl allow attackers to have unspecified impact via a string of length 0xffffffff, which triggers a heap-based buffer overflow.

CVE-2016-9586

Curl is vulnerable to a buffer overflow when doing a large floating point output in libcurl's implementation of the printf() functions. If there are any applications that accept a format string from the outside without necessary input filtering, it could allow remote attacks.

CVE-2018-16839

Curl is vulnerable to a buffer overrun in the SASL authentication code that may lead to denial of service.

CVE-2018-16842

Curl is vulnerable to a heap-based buffer over-read in the tool_msgs.c:voutf() function that may result in information exposure and denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 7.38.0-4+deb8u13.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl several issues. This security issue was fixed :

  - CVE-2018-1000007: Prevent leaking authentication data to     third parties when following redirects (bsc#1077001)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that the libcurl library did not prevent     TLS session resumption when the client certificate had     changed. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate. (CVE-2016-5419)

  - It was found that the libcurl library did not check the     client certificate when choosing the TLS connection to     reuse. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate. (CVE-2016-5420)

  - It was found that the libcurl library using the NSS     (Network Security Services) library as TLS/SSL backend     incorrectly re-used client certificates for subsequent     TLS connections in certain cases. An attacker could     potentially use this flaw to hijack the authentication     of the connection by leveraging a previously created     connection with a different client certificate.
    (CVE-2016-7141)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201701-47 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers and bug reports referenced for details.
  Impact :

    Remote attackers could conduct a Man-in-the-Middle attack to obtain       sensitive information, cause a Denial of Service condition, or execute       arbitrary code.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppleGraphicsPowerManagement
  - Assets
  - Audio
  - Bluetooth
  - CoreCapture
  - CoreFoundation
  - CoreGraphics
  - CoreMedia External Displays
  - CoreMedia Playback
  - CoreStorage
  - CoreText
  - curl
  - Directory Services
  - Disk Images
  - FontParser
  - Foundation
  - Grapher
  - ICU
  - ImageIO
  - Intel Graphics Driver
  - IOFireWireFamily
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - IOSurface
  - Kernel
  - kext tools
  - libarchive
  - LibreSSL
  - OpenLDAP
  - OpenPAM
  - OpenSSL
  - Power Management
  - Security
  - syslog
  - WiFi
  - xar

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Furthermore, CVE-2016-6304, CVE-2016-7596, and CVE-2016-7604 also affect Mac OS X versions 10.10.5 and 10.11.6. However, this plugin does not check those versions.

Security Fix(es) :

  - It was found that the libcurl library did not prevent     TLS session resumption when the client certificate had     changed. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate. (CVE-2016-5419)

  - It was found that the libcurl library did not check the     client certificate when choosing the TLS connection to     reuse. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate. (CVE-2016-5420)

  - It was found that the libcurl library using the NSS     (Network Security Services) library as TLS/SSL backend     incorrectly re-used client certificates for subsequent     TLS connections in certain cases. An attacker could     potentially use this flaw to hijack the authentication     of the connection by leveraging a previously created     connection with a different client certificate.
    (CVE-2016-7141)

Additional Changes :

An update for curl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es) :

* It was found that the libcurl library did not prevent TLS session resumption when the client certificate had changed. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. (CVE-2016-5419)

* It was found that the libcurl library did not check the client certificate when choosing the TLS connection to reuse. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. (CVE-2016-5420)

* It was found that the libcurl library using the NSS (Network Security Services) library as TLS/SSL backend incorrectly re-used client certificates for subsequent TLS connections in certain cases.
An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. (CVE-2016-7141)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

From Red Hat Security Advisory 2016:2575 :

An update for curl is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es) :

* It was found that the libcurl library did not prevent TLS session resumption when the client certificate had changed. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. (CVE-2016-5419)

* It was found that the libcurl library did not check the client certificate when choosing the TLS connection to reuse. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. (CVE-2016-5420)

* It was found that the libcurl library using the NSS (Network Security Services) library as TLS/SSL backend incorrectly re-used client certificates for subsequent TLS connections in certain cases.
An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate. (CVE-2016-7141)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

It was discovered that curl incorrectly reused client certificates when built with NSS. A remote attacker could possibly use this issue to hijack the authentication of a TLS connection. (CVE-2016-7141)

Nguyen Vu Hoang discovered that curl incorrectly handled escaping certain strings. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-7167)

It was discovered that curl incorrectly handled storing cookies. A remote attacker could possibly use this issue to inject cookies for arbitrary domains in the cookie jar. (CVE-2016-8615)

It was discovered that curl incorrect handled case when comparing user names and passwords. A remote attacker with knowledge of a case-insensitive version of the correct password could possibly use this issue to cause a connection to be reused. (CVE-2016-8616)

It was discovered that curl incorrect handled memory when encoding to base64. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-8617)

It was discovered that curl incorrect handled memory when preparing formatted output. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-8618)

It was discovered that curl incorrect handled memory when performing Kerberos authentication. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-8619)

Luat Nguyen discovered that curl incorrectly handled parsing globs. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 16.10. (CVE-2016-8620)

Luat Nguyen discovered that curl incorrectly handled converting dates. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. (CVE-2016-8621)

It was discovered that curl incorrectly handled URL percent-encoding decoding. A remote attacker could possibly use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-8622)

It was discovered that curl incorrectly handled shared cookies. A remote server could possibly obtain incorrect cookies or other sensitive information. (CVE-2016-8623)

Fernando Munoz discovered that curl incorrect parsed certain URLs. A remote attacker could possibly use this issue to trick curl into connecting to a different host. (CVE-2016-8624).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues :

  - CVE-2016-5419: TLS session resumption client cert bypass     (bsc#991389)

  - CVE-2016-5420: Re-using connections with wrong client     cert (bsc#991390)

  - CVE-2016-7141: Fixed incorrect reuse of client     certificates (bsc#997420).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

After testing original CVE-2016-5420 patch, it was discovered that libcurl built on top of NSS (Network Security Services) still incorrectly re-uses client certificates if a certificate from file is used for one TLS connection but no certificate is set for a subsequent TLS connection.

This update for curl fixes the following issues :

Security issues fixed :

  - CVE-2016-5419: TLS session resumption client cert bypass     (bsc#991389)

  - CVE-2016-5420: Re-using connections with wrong client     cert (bsc#991390)

  - CVE-2016-5421: use of connection struct after free     (bsc#991391)

  - CVE-2016-7141: Fixed incorrect reuse of client     certificates with NSS (bsc#997420)

Also the following bug was fixed :

  - fixing a performance issue (bsc#991746)

This update was imported from the SUSE:SLE-12:Update update project.

This update for curl fixes the following issues: Security issues fixed :

  - CVE-2016-5419: TLS session resumption client cert bypass     (bsc#991389)

  - CVE-2016-5420: Re-using connections with wrong client     cert (bsc#991390)

  - CVE-2016-5421: use of connection struct after free     (bsc#991391)

  - CVE-2016-7141: Fixed incorrect reuse of client     certificates with NSS (bsc#997420) Also the following     bug was fixed :

  - fixing a performance issue (bsc#991746)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that libcurl built on top of NSS (Network Security Services) incorrectly re-used client certificates if a certificate from file was used for one TLS connection but no certificate set for a subsequent TLS connection.

For Debian 7 'Wheezy', this problem has been fixed in version 7.26.0-1+wheezy15.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
125002	EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1549)	Nessus	Huawei Local Security Checks	critical
118753	Debian DLA-1568-1 : curl security update	Nessus	Debian Local Security Checks	critical
106435	SUSE SLES11 Security Update : curl (SUSE-SU-2018:0230-1)	Nessus	SuSE Local Security Checks	critical
99834	EulerOS 2.0 SP1 : curl (EulerOS-SA-2016-1074)	Nessus	Huawei Local Security Checks	high
96644	GLSA-201701-47 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
95917	macOS 10.12.x < 10.12.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
95835	Scientific Linux Security Update : curl on SL7.x x86_64 (20161103)	Nessus	Scientific Linux Local Security Checks	high
95322	CentOS 7 : curl (CESA-2016:2575)	Nessus	CentOS Local Security Checks	high
94698	Oracle Linux 7 : curl (ELSA-2016-2575)	Nessus	Oracle Linux Local Security Checks	high
94574	Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerabilities (USN-3123-1)	Nessus	Ubuntu Local Security Checks	critical
94538	RHEL 7 : curl (RHSA-2016:2575)	Nessus	Red Hat Local Security Checks	high
93862	SUSE SLES11 Security Update : curl (SUSE-SU-2016:2449-1)	Nessus	SuSE Local Security Checks	high
93743	Amazon Linux AMI : curl (ALAS-2016-742)	Nessus	Amazon Linux Local Security Checks	critical
93708	openSUSE Security Update : curl (openSUSE-2016-1124)	Nessus	SuSE Local Security Checks	high
93591	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2016:2330-1)	Nessus	SuSE Local Security Checks	high
93414	Debian DLA-616-1 : curl security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-7141

high

Tenable Plugins

critical

critical

critical

high

critical

high

high

high

high

critical

high

high

critical

high

high

high