FreeBSD : curl -- multiple vulnerabilities (0d7d104c-c6fb-11ed-8a4b-080027f5fec9)

high Nessus Plugin ID 173330

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 0d7d104c-c6fb-11ed-8a4b-080027f5fec9 advisory.

- The vulnerability exists due to missing documentation of the TELNET protocol support and the ability to pass on user name and telnet options for the server negotiation. A remote attacker can manipulate the connection sending unexpected data to the server via the affected client. (CVE-2023-27533)

- The vulnerability exists due to insufficient validation of user-supplied input in the SFTP support when handling the tilde ~ character in the filepath. cURL will replace the tilde character to the current user's home directory and can reveal otherwise restricted files. (CVE-2023-27534)

- The vulnerability exists due to cURL will reuse a previously created FTP connection even when one or more options had been changed that could have made the effective user a very different one. A remote attacker can connect to the FTP server using credentials supplied by another user and gain access to otherwise restricted functionality. (CVE-2023-27535)

- The vulnerability exists due to cURL will reuse a previously created connection even when the GSS delegation (CURLOPT_GSSAPI_DELEGATION) option had been changed that could have changed the user's permissions in a second transfer. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers. (CVE-2023-27536)

- The vulnerability exists due to a boundary error when sharing HSTS data between connection. A remote attacker can initiate HSTS connection, trigger a double free error and execute arbitrary code on the target system. (CVE-2023-27537)

- The vulnerability exists due to the way libcurl handles previously used connections in a connection pool for subsequent transfers. Several SSH settings were left out from the configuration match checks, resulting in erroneous matches for different resources. As a result, libcurl can send authentication string from one resource to another, exposing credentials to a third-party. (CVE-2023-27538)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 173330

File Name: freebsd_pkg_0d7d104cc6fb11ed8a4b080027f5fec9.nasl

Version: 1.5

Type: local

Family: FreeBSD Local Security Checks

Published: 3/23/2023

Updated: 6/1/2023

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2023-27533

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2023-27534

Vulnerability Information

CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:curl

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 3/20/2023

Vulnerability Publication Date: 3/20/2023

Reference Information

CVE: CVE-2023-27533, CVE-2023-27534, CVE-2023-27535, CVE-2023-27536, CVE-2023-27537, CVE-2023-27538

IAVA: 2023-A-0153-S

Detections

Analytics