curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.

The remote host is running a version of Mac OS X that is 10.13.x prior to 10.13.1. It is, therefore, affected by multiple vulnerabilities in the following components :

 - APFS
 - curl
 - Dictionary Widget
 - Kernel
 - StreamingZip
 - tcpdump
 - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

An update of the curl package has been released.

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components :

  - 802.1X
  - apache
  - AppleScript
  - ATS
  - Audio
  - CFString
  - CoreText
  - curl
  - Dictionary Widget
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - ImageIO
  - Kernel
  - libarchive
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - Sandbox
  - StreamingZip
  - tcpdump
  - Wi-Fi

The remote host is running a version of Mac OS X that is 10.13.x prior to 10.13.1. It is, therefore, affected by multiple vulnerabilities in the following components :

  - APFS
  - curl
  - Dictionary Widget
  - Kernel
  - StreamingZip
  - tcpdump
  - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Daniel Stenberg discovered that curl incorrectly handled large floating point output. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-9586)

Even Rouault discovered that curl incorrectly handled large file names when doing TFTP transfers. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain sensitive memory contents. (CVE-2017-1000100)

Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handled numerical range globbing. A remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain sensitive memory contents. (CVE-2017-1000101)

Max Dymond discovered that curl incorrectly handled FTP PWD responses.
A remote attacker could use this issue to cause curl to crash, resulting in a denial of service. (CVE-2017-1000254)

Brian Carpenter discovered that curl incorrectly handled the
--write-out command line option. A local attacker could possibly use this issue to obtain sensitive memory contents. (CVE-2017-7407).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-1000100     Even Rouault reported that cURL does not properly handle     long file names when doing an TFTP upload. A malicious     HTTP(S) server can take advantage of this flaw by     redirecting a client using the cURL library to a crafted     TFTP URL and trick it to send private memory contents to     a remote server over UDP.

  - CVE-2017-1000101     Brian Carpenter and Yongji Ouyang reported that cURL     contains a flaw in the globbing function that parses the     numerical range, leading to an out-of-bounds read when     parsing a specially crafted URL.

  - CVE-2017-1000254     Max Dymond reported that cURL contains an out-of-bounds     read flaw in the FTP PWD response parser. A malicious     server can take advantage of this flaw to effectively     prevent a client using the cURL library to work with it,     causing a denial of service.

The remote host is affected by the vulnerability described in GLSA-201709-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition, obtain       sensitive information, or bypass intended restrictions for TLS sessions.
  Workaround :

    There is no known workaround at this time.

FILE buffer read out of bounds (CVE-2017-1000099)

TFTP sends more than buffer size (CVE-2017-1000100)

URL globbing out of bounds read (CVE-2017-1000101)

This update for curl fixes the following issues :

  - CVE-2017-1000100: TFP sends more than buffer size and it     could lead to a denial of service (bsc#1051644)

  - CVE-2017-1000101: URL globbing out of bounds read could     lead to a denial of service (bsc#1051643)

This update was imported from the SUSE:SLE-12:Update update project.

This update for curl fixes the following issues :

  - CVE-2017-1000100: TFP sends more than buffer size and it     could lead to a denial of service (bsc#1051644)

  - CVE-2017-1000101: URL globbing out of bounds read could     lead to a denial of service (bsc#1051643)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes for CVE-2017-1000100 and CVE-2017-1000101

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

The cURL project reports :

- FILE buffer read out of bounds

- TFTP sends more than buffer size

- URL globbing out of bounds read

ID	Name	Product	Family	Severity
700512	macOS 10.13.x < 10.13.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
121761	Photon OS 2.0: Curl PHSA-2017-0045	Nessus	PhotonOS Local Security Checks	medium
104379	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-001 and 2017-004)	Nessus	MacOS X Local Security Checks	critical
104378	macOS 10.13.x < 10.13.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
103773	Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerabilities (USN-3441-1)	Nessus	Ubuntu Local Security Checks	high
103715	Debian DSA-3992-1 : curl - security update	Nessus	Debian Local Security Checks	high
103282	GLSA-201709-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
102877	Amazon Linux AMI : curl (ALAS-2017-889)	Nessus	Amazon Linux Local Security Checks	medium
102566	openSUSE Security Update : curl (openSUSE-2017-951)	Nessus	SuSE Local Security Checks	medium
102540	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:2174-1)	Nessus	SuSE Local Security Checks	medium
102463	Fedora 25 : curl (2017-f2df9d7772)	Nessus	Fedora Local Security Checks	medium
102462	Fedora 26 : curl (2017-f1ffd18079)	Nessus	Fedora Local Security Checks	medium
102365	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : curl (SSA:2017-221-01)	Nessus	Slackware Local Security Checks	medium
102330	FreeBSD : cURL -- multiple vulnerabilities (69cfa386-7cd0-11e7-867f-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2017-1000101

medium

Tenable Plugins

critical

medium

critical

high

high

high

high

medium

medium

medium

medium

medium

medium

medium