Detections
Analytics
AlmaLinux 9 : curl (ALSA-2023:5763)
critical Nessus Plugin ID 183257
Synopsis
The remote AlmaLinux host is missing one or more security updates.Description
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:5763 advisory.- CVE-2023-38545 is a heap-based buffer overflow vulnerability in the SOCKS5 proxy handshake in libcurl and curl. When curl is given a hostname to pass along to a SOCKS5 proxy that is greater than 255 bytes in length, it will switch to local name resolution in order to resolve the address before passing it on to the SOCKS5 proxy. However, due to a bug introduced in 2020, this local name resolution could fail due to a slow SOCKS5 handshake, causing curl to pass on the hostname greater than 255 bytes in length into the target buffer, leading to a heap overflow. The advisory for CVE-2023-38545 gives an example exploitation scenario of a malicious HTTPS server redirecting to a specially crafted URL. While it might seem that an attacker would need to influence the slowness of the SOCKS5 handshake, the advisory states that server latency is likely slow enough to trigger this bug. (CVE-2023-38545)
- CVE-2023-38546 is a cookie injection vulnerability in the curl_easy_duphandle(), a function in libcurl that duplicates easy handles. When duplicating an easy handle, if cookies are enabled, the duplicated easy handle will not duplicate the cookies themselves, but would instead set the filename to none.' Therefore, when the duplicated easy handle is subsequently used, if a source was not set for the cookies, libcurl would attempt to load them from the file named none' on the disk. This vulnerability is rated low, as the various conditions required for exploitation are unlikely. (CVE-2023-38546)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Critical
ID: 183257
File Name: alma_linux_ALSA-2023-5763.nasl
Version: 1.4
Type: local
Family: Alma Linux Local Security Checks
Published: 10/17/2023
Updated: 12/8/2023
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 7.4
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-38545
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:alma:linux:9::baseos, cpe:/o:alma:linux:9::supplementary, cpe:/o:alma:linux:9::sap, cpe:/o:alma:linux:9::appstream, p-cpe:/a:alma:linux:curl, cpe:/o:alma:linux:9::highavailability, cpe:/o:alma:linux:9, cpe:/o:alma:linux:9::realtime, cpe:/o:alma:linux:9::resilientstorage, cpe:/o:alma:linux:9::sap_hana, p-cpe:/a:alma:linux:libcurl, cpe:/o:alma:linux:9::nfv, cpe:/o:alma:linux:9::crb, p-cpe:/a:alma:linux:curl-minimal, p-cpe:/a:alma:linux:libcurl-devel, p-cpe:/a:alma:linux:libcurl-minimal
Required KB Items: Host/local_checks_enabled, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 10/17/2023
Vulnerability Publication Date: 10/10/2023
Reference Information
CVE: CVE-2023-38545, CVE-2023-38546