New curl packages are available for Slackware 14.0, and -current to fix a security issue.

fix buffer overflow when negotiating SASL DIGEST-MD5 auth (CVE-2013-0249)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201401-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated process to connect to       a malicious server using cURL, possibly resulting in the remote execution       of arbitrary code or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

It was discovered that curl incorrectly handled SASL authentication when communicating over POP3, SMTP or IMAP. If a user or automated system were tricked into processing a specially crafted URL, an attacker could cause a denial of service, or possibly execute arbitrary code. The default compiler options for affected releases should reduce the vulnerability to a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.x that is prior to version 10.9. The newer version contains multiple security-related fixes for the following components :

  - Application Firewall
  - App Sandbox
  - Bluetooth
  - CFNetwork
  - CFNetwork SSL
  - Console
  - CoreGraphics
  - curl
  - dyld
  - IOKitUser
  - IOSerialFamily
  - Kernel
  - Kext Management
  - LaunchServices
  - Libc
  - Mail Accounts
  - Mail Header Display
  - Mail Networking
  - OpenLDAP
  - perl
  - Power Management
  - python
  - ruby
  - Security
  - Security - Authorization
  - Security - Smart Card Services
  - Screen Lock
  - Screen Sharing Server
  - syslog
  - USB

A stack buffer overflow flaw was found due to the application failing to properly bounds-check user supplied data before copying it into an insufficiently sized buffer. A remote attacker could exploit this issue to execute arbitrary code in the context of the affected application. (CVE-2013-2174)

Affected versions include versions 7.26.0 through 7.28.1.

ID	Name	Product	Family	Published	Updated	Severity
64491	Slackware 14.0 / current : curl (SSA:2013-038-01)	Nessus	Slackware Local Security Checks	2/8/2013	1/14/2021	high
64869	Fedora 18 : curl-7.27.0-6.fc18 (2013-2098)	Nessus	Fedora Local Security Checks	2/25/2013	1/11/2021	high
72053	GLSA-201401-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	1/21/2014	1/6/2021	high
64619	Ubuntu 12.10 : curl vulnerability (USN-1721-1)	Nessus	Ubuntu Local Security Checks	2/13/2013	9/19/2019	high
70561	Mac OS X 10.x < 10.9 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	10/23/2013	12/5/2022	high
6901	cURL/libcURL 'Curl_sasl_create_digest_md5_message()' Stack Buffer Overflow	Nessus Network Monitor	Web Clients	7/1/2013	3/6/2019	high
801393	cURL/libcURL 'Curl_sasl_create_digest_md5_message()' Stack Buffer Overflow Vulnerability	Log Correlation Engine	Web Clients	7/1/2013		medium

Detections

Analytics

Plugins Search

high

high

high

high

high

high

medium