This update of gnutls improves the verification of the domain/subject names in a SSL certificate. CVE-2009-2417 has been assigned to this issue.

This update of libcurl2 fixes the 0-character handling in the subject name of a SSL certificate. This bug could be used to execute an undetected man-in-the-middle-attack. (CVE-2009-2417)

Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation, handing the server a copy of the client's security credential. (CVE-2011-2192)

Wesley Miaw discovered that when zlib is enabled, libcurl does not properly restrict the amount of callback data sent to an application that requests automatic decompression. This might allow an attacker to cause a denial of service via an application crash or possibly execute arbitrary code with the privilege of the application. This issue only affected Ubuntu 8.04 LTS and Ubuntu 10.04 LTS. (CVE-2010-0734)

USN 818-1 fixed an issue with curl's handling of SSL certificates with zero bytes in the Common Name. Due to a packaging error, the fix for this issue was not being applied during the build. This issue only affected Ubuntu 8.04 LTS. We apologize for the error. (CVE-2009-2417)

Scott Cantor discovered that curl did not correctly handle SSL certificates with zero bytes in the Common Name. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in the following components :

  - Apache Geronimo
  - Apache Tomcat
  - Apache Xerces2
  - cURL/libcURL
  - ISC BIND
  - Libxml2
  - Linux kernel
  - Linux kernel 64-bit
  - Linux kernel Common Internet File System
  - Linux kernel eCryptfs
  - NTP
  - Python
  - Java Runtime Environment (JRE)
  - Java SE Development Kit (JDK)
  - Java SE Abstract Window Toolkit (AWT)
  - Java SE Plugin
  - Java SE Provider
  - Java SE Swing
  - Java SE Web Start

The remote MiracleLinux 3 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2009-376:02 advisory.

    cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the     supported protocols. cURL is designed to work without user interaction or any kind of interactivity. cURL     offers many useful capabilities, like proxy support, user authentication, FTP upload, HTTP post, and file     transfer resume.
    Fixed bugs:
    CVE-2009-2417     lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '0'     character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows     man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a     legitimate Certification Authority, a related issue to CVE-2009-2408.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
41517	SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 6470)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
41497	SuSE 10 Security Update : curl (ZYPP Patch Number 6402)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
41317	SuSE9 Security Update : curl (YOU Patch Number 12467)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	high
55414	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : curl vulnerabilities (USN-1158-1)	Nessus	Ubuntu Local Security Checks	2011/6/24	2019/9/19	high
89117	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check)	Nessus	Misc.	2016/3/3	2021/1/6	critical
291378	MiracleLinux 3 : curl-7.15.5-2.1AXS3.5 (AXSA:2009-376:02)	Nessus	Miracle Linux Local Security Checks	2026/1/19	2026/1/19	medium
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2010/3/29	2024/5/28	critical
42012	openSUSE 10 Security Update : libcurl3 (libcurl3-6401)	Nessus	SuSE Local Security Checks	2009/10/6	2021/1/14	high
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	2010/3/29	2024/5/28	critical

检测

插件搜索

high

high

high

high

critical

medium

critical

high

critical