GLSA-200903-21 : cURL: Arbitrary file access
Medium Nessus Plugin ID 35819
SynopsisThe remote Gentoo host is missing one or more security-related patches.
DescriptionThe remote host is affected by the vulnerability described in GLSA-200903-21 (cURL: Arbitrary file access)
David Kierznowski reported that the redirect implementation accepts arbitrary Location values when CURLOPT_FOLLOWLOCATION is enabled.
A remote attacker could possibly exploit this vulnerability to make remote HTTP servers trigger arbitrary requests to intranet servers and read or overwrite arbitrary files via a redirect to a file: URL, or, if the libssh2 USE flag is enabled, execute arbitrary commands via a redirect to an scp: URL.
There is no known workaround at this time.
SolutionAll cURL users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose '>=net-misc/curl-7.19.4'