The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, as demonstrated by "*.com."

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - curl before version 7.52.0 is vulnerable to a buffer overflow when doing a large floating point output in
    libcurl's implementation of the printf() functions. If there are any application that accepts a format
    string from the outside without necessary input filtering, it could allow remote attacks. (CVE-2016-9586)

  - curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that
    returns a good 32bit random value. Having a weak or virtually non-existent random value makes the
    operations that use it vulnerable. (CVE-2016-9594)

  - The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for
    Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-in-the-
    middle attacks via a crafted wildcard SAN in a server certificate, as demonstrated by "*.com."
    (CVE-2016-9952)

  - The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for
    Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause
    a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name,
    which triggers an out-of-bounds read. (CVE-2016-9953)

ID	Name	Product	Family	Severity
423782	Alpine: libcurl, multiple curl packages: security update to 7.52.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
423782	Alpine: libcurl, multiple curl packages: security update to 7.52.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
403962	Alpine: curl: security update to 7.52.1-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
403962	Alpine: curl: security update to 7.52.1-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical

Detections

Analytics

CVE-2016-9952

high

Tenable Plugins

critical

critical

critical

critical