This update of libcurl2 fixes the 0-character handling in the subject name of a SSL certificate. This bug could be used to execute an undetected man-in-the-middle-attack. (CVE-2009-2417)

This update of gnutls improves the verification of the domain/subject names in a SSL certificate. CVE-2009-2417 has been assigned to this issue.

The remote host is affected by the vulnerability described in GLSA-200909-20 (cURL: Certificate validation error)

    Scott Cantor reported that cURL does not properly handle fields in     X.509 certificates that contain an ASCII NUL (\\0) character.
    Specifically, the processing of such fields is stopped at the first     occurence of a NUL character. This type of vulnerability was recently     discovered by Dan Kaminsky and Moxie Marlinspike.
  Impact :

    A remote attacker might employ a specially crafted X.509 certificate     (that for instance contains a NUL character in the Common Name field)     to conduct man-in-the-middle attacks.
  Workaround :

    There is no known workaround at this time.

It was discovered that curl, a client and library to get files from servers using HTTP, HTTPS or FTP, is vulnerable to the 'Null Prefix Attacks Against SSL/TLS Certificates' recently published at the Blackhat conference. This allows an attacker to perform undetected man-in-the-middle attacks via a crafted ITU-T X.509 certificate with an injected null byte in the Common Name field.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-1209 advisory.

    [7.15.5-2.1.el5_3.5]
    - fix CVE-2009-2417 (#516257)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - Apache Geronimo
  - Apache Tomcat
  - Apache Xerces2
  - cURL/libcURL
  - ISC BIND
  - Libxml2
  - Linux kernel
  - Linux kernel 64-bit
  - Linux kernel Common Internet File System
  - Linux kernel eCryptfs
  - NTP
  - Python
  - Java Runtime Environment (JRE)
  - Java SE Development Kit (JDK)
  - Java SE Abstract Window Toolkit (AWT)
  - Java SE Plugin
  - Java SE Provider
  - Java SE Swing
  - Java SE Web Start

Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation, handing the server a copy of the client's security credential. (CVE-2011-2192)

Wesley Miaw discovered that when zlib is enabled, libcurl does not properly restrict the amount of callback data sent to an application that requests automatic decompression. This might allow an attacker to cause a denial of service via an application crash or possibly execute arbitrary code with the privilege of the application. This issue only affected Ubuntu 8.04 LTS and Ubuntu 10.04 LTS. (CVE-2010-0734)

USN 818-1 fixed an issue with curl's handling of SSL certificates with zero bytes in the Common Name. Due to a packaging error, the fix for this issue was not being applied during the build. This issue only affected Ubuntu 8.04 LTS. We apologize for the error. (CVE-2009-2417)

Scott Cantor discovered that curl did not correctly handle SSL certificates with zero bytes in the Common Name. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
41317	SuSE9 Security Update : curl (YOU Patch Number 12467)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
41497	SuSE 10 Security Update : curl (ZYPP Patch Number 6402)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
41517	SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 6470)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
41637	GLSA-200909-20 : cURL: Certificate validation error	Nessus	Gentoo Local Security Checks	2009/9/28	2021/1/6	high
42011	openSUSE 10 Security Update : libcurl2 (libcurl2-6404)	Nessus	SuSE Local Security Checks	2009/10/6	2021/1/14	high
44734	Debian DSA-1869-1 : curl - insufficient input validation	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
67910	Oracle Linux 5 : curl (ELSA-2009-1209)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	medium
89117	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check)	Nessus	Misc.	2016/3/3	2021/1/6	critical
55414	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : curl vulnerabilities (USN-1158-1)	Nessus	Ubuntu Local Security Checks	2011/6/24	2019/9/19	high

检测

插件搜索

high

high

high

high

high

high

medium

critical

high