このcurl用更新プログラムでは、以下の問題が修正されています：

修正されたセキュリティ問題：

  - CVE-2019-3823：SMTPの応答終了を処理するコードでのヒープ領域外読み取りを修正しました（bsc#1123378）。

  - CVE-2019-3822：送信NTLM type-3メッセージを作成する関数のスタックベースのバッファオーバーフローを修正しました（bsc#1123377）。

  - CVE-2018-16890：着信NTLM type-2メッセージを処理する関数におけるヒープバッファ領域外読み取りを修正しました（bsc#1123371）。

この更新はSUSEからインポートされました：SLE-15：更新プロジェクトを更新します。

curlの更新プログラムが、Red Hat Enterprise Linux 8で利用可能になりました。Red Hat製品セキュリティは、この更新がセキュリティに及ぼす影響の重要度を中程度と評価しています。詳細な重大度評価を示すCVSS（共通脆弱性評価システム）ベーススコアは、「参照」セクションのCVEリンクから脆弱性ごとに入手できます。curl パッケージは、HTTP、FTP、LDAP を含む、様々なプロトコルを使用してサーバーからファイルをダウンロードするための libcurl ライブラリおよび curl ユーティリティを提供します。セキュリティ修正プログラム： * curl：NTLMタイプ2の領域外バッファオーバーリード（CVE-2018-16890）* wget：xattr.cのset_file_metadata関数における情報漏えい（CVE-2018-20483）* curl：NTLMv2タイプ3のヘッダーのスタックベースバッファオーバーフロー（CVE-2019-3822）* curl：SMTPのレスポンス終了の領域外読み取り（CVE-2019-3823）影響、CVSSスコア、謝辞、その他の関連情報を含むセキュリティ問題の詳細については、「参照」セクションに記載されているCVEのページを参照してください。追加の変更：このリリースの変更に関する詳細については、「参照」セクションからリンクされているRed Hat Enterprise Linux 8.1リリースノートを参照してください。

An update of the cmake package has been released.

Multiple vulnerabilities were discovered in cURL, an URL transfer library.

  - CVE-2018-16890     Wenxiang Qian of Tencent Blade Team discovered that the     function handling incoming NTLM type-2 messages does not     validate incoming data correctly and is subject to an     integer overflow vulnerability, which could lead to an     out-of-bounds buffer read.

  - CVE-2019-3822     Wenxiang Qian of Tencent Blade Team discovered that the     function creating an outgoing NTLM type-3 header is     subject to an integer overflow vulnerability, which     could lead to an out-of-bounds write.

  - CVE-2019-3823     Brian Carpenter of Geeknik Labs discovered that the code     handling the end-of-response for SMTP is subject to an     out-of-bounds heap read.

New curl packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3882-1 advisory.

    Wenxiang Qian discovered that curl incorrectly handled certain NTLM authentication messages. A remote     attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. This     issue only applied to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10. (CVE-2018-16890)

    Wenxiang Qian discovered that curl incorrectly handled certain NTLMv2 authentication messages. A remote     attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10.
    (CVE-2019-3822)

    Brian Carpenter discovered that curl incorrectly handled certain SMTP responses. A remote attacker could     possibly use this issue to cause curl to crash, resulting in a denial of service. (CVE-2019-3823)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

curl security problems :

CVE-2018-16890: NTLM type-2 out-of-bounds buffer read

libcurl contains a heap buffer out-of-bounds read flaw.

The function handling incoming NTLM type-2 messages (lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming data correctly and is subject to an integer overflow vulnerability.

Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

CVE-2019-3822: NTLMv2 type-3 header stack-based buffer overflow

libcurl contains a stack based buffer overflow vulnerability.

The function creating an outgoing NTLM type-3 header (lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()), generates the request HTTP header contents based on previously received data.
The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening.

This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server.

Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.

CVE-2019-3823: SMTP end-of-response out-of-bounds read

libcurl contains a heap out-of-bounds read in the code handling the end-of-response for SMTP.

If the buffer passed to smtp_endofresp() isn't NUL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol() call reads beyond the allocated buffer. The read contents will not be returned to the caller.

This update for curl fixes the following issues :

Security issues fixed :

  - CVE-2019-3823: Fixed a heap out-of-bounds read in the     code handling the end-of-response for SMTP     (bsc#1123378).

  - CVE-2019-3822: Fixed a stack based buffer overflow in     the function creating an outgoing NTLM type-3 message     (bsc#1123377).

  - CVE-2018-16890: Fixed a heap buffer out-of-bounds read     in the function handling incoming NTLM type-2 messages     (bsc#1123371).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3701 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: NTLM type-2 heap out-of-bounds buffer read (CVE-2018-16890)

    * wget: Information exposure in set_file_metadata function in xattr.c (CVE-2018-20483)

    * curl: NTLMv2 type-3 header stack buffer overflow (CVE-2019-3822)

    * curl: SMTP end-of-response out-of-bounds read (CVE-2019-3823)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
122221	openSUSEセキュリティ更新プログラム：curl（openSUSE-2019-174）	Nessus	SuSE Local Security Checks	2/15/2019	6/20/2024	critical
130568	RHEL 8：curl（RHSA-2019:3701）	Nessus	Red Hat Local Security Checks	11/6/2019	3/16/2025	critical
203839	Photon OS 3.0: Cmake PHSA-2023-3.0-0603	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	critical
121628	Debian DSA-4386-1 : curl - security update	Nessus	Debian Local Security Checks	2/7/2019	6/24/2024	critical
121632	Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2019-037-01)	Nessus	Slackware Local Security Checks	2/7/2019	6/24/2024	critical
121639	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : curl vulnerabilities (USN-3882-1)	Nessus	Ubuntu Local Security Checks	2/7/2019	8/27/2024	critical
122042	FreeBSD : curl -- multiple vulnerabilities (714b033a-2b09-11e9-8bc3-610fd6e6cd05)	Nessus	FreeBSD Local Security Checks	2/8/2019	6/21/2024	critical
122221	openSUSE Security Update : curl (openSUSE-2019-174)	Nessus	SuSE Local Security Checks	2/15/2019	6/20/2024	critical
130568	RHEL 8 : curl (RHSA-2019:3701)	Nessus	Red Hat Local Security Checks	11/6/2019	3/16/2025	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical