The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has curl packages installed that are affected by multiple vulnerabilities:

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a CWE-126: Buffer Over-read vulnerability in     denial of service that can result in curl can be tricked     into reading data beyond the end of a heap based buffer     used to store downloaded RTSP content.. This     vulnerability appears to have been fixed in curl <     7.20.0 and curl >= 7.60.0. (CVE-2018-1000301)

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL to     an application using libcurl, could write a NULL byte at     an arbitrary location, resulting in a crash or an     unspecified behavior. (CVE-2018-1000120)

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP reply.
    (CVE-2018-1000121)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code that     allows an attacker to cause a denial of service or     information leakage (CVE-2018-1000122)

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external entities.
    (CVE-2018-1000007)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

Curl version curl 7.54.1 to and including curl 7.59.0 contains a CWE-122: Heap-based Buffer Overflow vulnerability in denial of service and more that can result in curl might overflow a heap based memory buffer when closing down an FTP connection with very long server command replies.(CVE-2018-1000300)

Curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content.(CVE-2018-1000301)

OSS-fuzz, assisted by Max Dymond, discovered that cURL, an URL transfer library, could be tricked into reading data beyond the end of a heap based buffer when parsing invalid headers in an RTSP response.

This update for curl fixes several issues: Security issues fixed :

  - CVE-2018-1000301: Fixed a RTSP bad headers buffer     over-read could crash the curl client (bsc#1092098) Non     security issues fixed :

  - If the DEFAULT_SUSE cipher list is not available use the     HIGH cipher alias before failing. (bsc#1086825)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - curl: HTTP authentication leak in redirects     (CVE-2018-1000007)

  - curl: FTP path trickery leads to NIL byte out of bounds     write (CVE-2018-1000120)

  - curl: RTSP RTP buffer over-read (CVE-2018-1000122)

  - curl: Out-of-bounds heap read when missing RTSP headers     allows information leak of denial of service     (CVE-2018-1000301)

  - curl: LDAP NULL pointer dereference (CVE-2018-1000121)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0544 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: HTTP authentication leak in redirects (CVE-2018-1000007)

    * curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)

    * curl: RTSP RTP buffer over-read (CVE-2018-1000122)

    * curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service     (CVE-2018-1000301)

    * curl: LDAP NULL pointer dereference (CVE-2018-1000121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - curl before version 7.61.1 is vulnerable to a buffer     overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the     length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap.
    The length value is then subsequently used to iterate     over the password and generate output into the     allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer     overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very     small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer     end up in a heap buffer overflow. (This bug is almost     identical to CVE-2017-8816.)(CVE-2018-14618)

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage.(CVE-2018-1000122)

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a CWE-126: Buffer Over-read vulnerability in     denial of service that can result in curl can be     tricked into reading data beyond the end of a heap     based buffer used to store downloaded RTSP content..
    (CVE-2018-1000301)

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker     could exploit this flaw to potentially cause     information disclosure or crash the     application.(CVE-2017-1000257)

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external entities.
    (CVE-2018-1000007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:

  - An unspecified vulnerability in the subcomponent Networking     (jQuery) of Enterprise Manager Ops Center. Supported versions     that are affected are 12.2.2 and 12.3.3. An easy to exploit     vulnerability could allow an unauthenticated attacker with     network access via HTTP to compromise Enterprise Manager Ops     Center. A successful attacks requires human interaction and     can result in unauthorized update, insert or delete access     to some of Enterprise Manager Ops Center accessible data.
    (CVE-2015-9251)

  - An unspecified vulnerability in the subcomponent Networking     (OpenSSL) of the Enterprise Manager Ops Center. Supported     versions that are affected are 12.2.2 and 12.3.3. An easy     to exploit vulnerability could allow an unauthenticated     attacker with network access via HTTPS to compromise     Enterprise Manager Ops Center. A successful attack of this     vulnerability could result in unauthorized ability to cause     a hang or frequently repeatable crash (complete DOS) of     Enterprise Manager Ops Center. (CVE-2018-0732)

  - An unspecified vulnerability in the subcomponent Networking     (cURL) of Enterprise Manager Ops Center. Supported versions     that are affected are 12.2.2 and 12.3.3. Difficult to exploit     vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Enterprise Manager Ops Center.
    A successful attack requires human interaction from a person     other than the attacker and can result in takeover of     Enterprise Manager Ops Center. (CVE-2018-1000300)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3558 advisory.

    The Apache HTTP Server is a powerful, efficient, and extensible web server. The httpd24 packages provide a     recent stable release of version 2.4 of the Apache HTTP Server, along with the mod_auth_kerb module.

    The following packages have been upgraded to a later upstream version: httpd24-httpd (2.4.34),     httpd24-curl (7.61.1). (BZ#1590833, BZ#1648928)

    Security Fix(es):

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)

    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)

    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)

    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)

    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)

    * httpd: <FilesMatch> bypass with a trailing newline in the file name (CVE-2017-15715)

    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)

    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Curl project for reporting CVE-2017-8816, CVE-2017-8817, CVE-2017-1000254,     CVE-2017-1000257, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000122, CVE-2018-1000301, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2018-14618, and CVE-2018-1000121. Upstream acknowledges Alex     Nichols as the original reporter of CVE-2017-8816; the OSS-Fuzz project as the original reporter of     CVE-2017-8817 and CVE-2018-1000301; Max Dymond as the original reporter of CVE-2017-1000254 and     CVE-2018-1000122; Brian Carpenter and the OSS-Fuzz project as the original reporters of CVE-2017-1000257;
    Craig de Stigter as the original reporter of CVE-2018-1000007; Duy Phan Thanh as the original reporter of     CVE-2018-1000120; Even Rouault as the original reporter of CVE-2017-1000100; Brian Carpenter as the     original reporter of CVE-2017-1000101; Zhaoyang Wu as the original reporter of CVE-2018-14618; and Dario     Weisser as the original reporter of CVE-2018-1000121.

    Bug Fix(es):

    * Previously, the Apache HTTP Server from the httpd24 Software Collection was unable to handle situations     when static content was repeatedly requested in a browser by refreshing the page. As a consequence, HTTP/2     connections timed out and httpd became unresponsive. This bug has been fixed, and HTTP/2 connections now     work as expected in the described scenario. (BZ#1518737)

    Enhancement(s):

    * This update adds the mod_md module to the httpd24 Software Collection. This module enables managing     domains across virtual hosts and certificate provisioning using the Automatic Certificate Management     Environment (ACME) protocol. The mod_md module is available only for Red Hat Enterprise Linux 7.
    (BZ#1640722)

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Software Collections 3.2 Release     Notes linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3739:01 advisory.

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)
    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)
    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)
    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)
    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)
    * httpd:  bypass with a trailing newline in the file name (CVE-2017-15715)
    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)
    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)
    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
127212	NewStart CGSL CORE 5.04 / MAIN 5.04 : curl Multiple Vulnerabilities (NS-SA-2019-0039)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	1/14/2021	critical
121963	Photon OS 2.0: Curl PHSA-2018-2.0-0068	Nessus	PhotonOS Local Security Checks	2/7/2019	7/22/2024	critical
110446	Amazon Linux 2 : curl (ALAS-2018-1029)	Nessus	Amazon Linux Local Security Checks	6/12/2018	9/24/2024	critical
109901	Debian DSA-4202-1 : curl - security update	Nessus	Debian Local Security Checks	5/18/2018	10/4/2024	critical
109913	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2018:1327-1)	Nessus	SuSE Local Security Checks	5/18/2018	10/4/2024	critical
119180	Scientific Linux Security Update : curl and nss-pem on SL7.x x86_64 (20181030)	Nessus	Scientific Linux Local Security Checks	11/27/2018	7/18/2024	critical
133787	RHEL 7 : curl (RHSA-2020:0544)	Nessus	Red Hat Local Security Checks	2/19/2020	11/7/2024	critical
124993	EulerOS Virtualization for ARM 64 3.0.1.0 : curl (EulerOS-SA-2019-1540)	Nessus	Huawei Local Security Checks	5/14/2019	5/22/2024	critical
131184	Oracle Enterprise Manager Ops Center (Jan 2019 CPU)	Nessus	Misc.	11/21/2019	11/4/2024	critical
194113	RHEL 6 / 7 : httpd24 (RHSA-2018:3558)	Nessus	Red Hat Local Security Checks	4/27/2024	3/16/2025	critical
289086	MiracleLinux 7 : httpd24-nghttp2-1.7.1-7.el7, httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7 (AXSA:2019-3739:01)	Nessus	Miracle Linux Local Security Checks	1/16/2026	1/16/2026	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical