openSUSE Security Update : curl (curl-1232)

High Nessus Plugin ID 40788


The remote openSUSE host is missing a security update.


curl did not detect embedded null characters in certificate names. By using specially crafted certificates attackers could exploit that to conduct man in the middle attacks (CVE-2009-2417).

Note the previous update that was supposed to fix the issue accidentally lacked the actual fix which was corrected this time.


Update the affected curl packages.

See Also

Plugin Details

Severity: High

ID: 40788

File Name: suse_11_1_curl-090820.nasl

Version: $Revision: 1.6 $

Type: local

Agent: unix

Published: 2009/08/27

Modified: 2014/06/13

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:curl, p-cpe:/a:novell:opensuse:libcurl-devel, p-cpe:/a:novell:opensuse:libcurl4, p-cpe:/a:novell:opensuse:libcurl4-32bit, cpe:/o:novell:opensuse:11.1

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2009/08/20

Reference Information

CVE: CVE-2009-2417

CWE: 310