Scientific Linux Security Update : curl on SL7.x x86_64

This script is Copyright (C) 2015 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

It was found that the libcurl library did not correctly handle partial
literal IP addresses when parsing received HTTP cookies. An attacker
able to trick a user into connecting to a malicious server could use
this flaw to set the user's cookie to a crafted domain, making other
cookie-related issues easier to exploit. (CVE-2014-3613)

A flaw was found in the way the libcurl library performed the
duplication of connection handles. If an application set the
CURLOPT_COPYPOSTFIELDS option for a handle, using the handle's
duplicate could cause the application to crash or disclose a portion
of its memory. (CVE-2014-3707)

It was discovered that the libcurl library failed to properly handle
URLs with embedded end-of-line characters. An attacker able to make an
application using libcurl access a specially crafted URL via an HTTP
proxy could use this flaw to inject additional headers to the request
or construct additional requests. (CVE-2014-8150)

It was discovered that libcurl implemented aspects of the NTLM and
Negotatiate authentication incorrectly. If an application uses libcurl
and the affected mechanisms in a specifc way, certain requests to a
previously NTLM-authenticated server could appears as sent by the
wrong authenticated user. Additionally, the initial set of credentials
for HTTP Negotiate- authenticated requests could be reused in
subsequent requests, although a different set of credentials was
specified. (CVE-2015-3143, CVE-2015-3148)

Bug fixes :

- An out-of-protocol fallback to SSL 3.0 was available
with libcurl. Attackers could abuse the fallback to
force downgrade of the SSL version. The fallback has
been removed from libcurl. Users requiring this
functionality can explicitly enable SSL 3.0 through the
libcurl API.

- TLS 1.1 and TLS 1.2 are no longer disabled by default in
libcurl. You can explicitly disable them through the
libcurl API.

- FTP operations such as downloading files took a
significantly long time to complete. Now, the FTP
implementation in libcurl correctly sets blocking
direction and estimated timeout for connections,
resulting in faster FTP transfers.

Enhancements :

- With the updated packages, it is possible to explicitly
enable or disable new Advanced Encryption Standard (AES)
cipher suites to be used for the TLS protocol.

- The libcurl library did not implement a non-blocking SSL
handshake, which negatively affected performance of
applications based on the libcurl multi API. The
non-blocking SSL handshake has been implemented in
libcurl, and the libcurl multi API now immediately
returns the control back to the application whenever it
cannot read or write data from or to the underlying
network socket.

- The libcurl library used an unnecessarily long blocking
delay for actions with no active file descriptors, even
for short operations. Some actions, such as resolving a
host name using /etc/hosts, took a long time to
complete. The blocking code in libcurl has been modified
so that the initial delay is short and gradually
increases until an event occurs.

See also :

http://www.nessus.org/u?5978e139

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 5.0
(CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 87554 ()

Bugtraq ID:

CVE ID: CVE-2014-3613
CVE-2014-3707
CVE-2014-8150
CVE-2015-3143
CVE-2015-3148

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now