The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - cURL and libcurl 7.1 before 7.36.0, when using the OpenSSL, axtls, qsossl or gskit libraries for TLS,     recognize a wildcard IP address in the subject's Common Name (CN) field of an X.509 certificate, which     might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by     a legitimate Certification Authority. (CVE-2014-0139)

Note that Nessus relies on the presence of the package as reported by the vendor.

Two vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2014-0138     Steve Holme discovered that libcurl can in some     circumstances re-use the wrong connection when asked to     do transfers using other protocols than HTTP and FTP.

  - CVE-2014-0139     Richard Moore from Westpoint Ltd. reported that libcurl     does not behave compliant to RFC 2828 under certain     conditions and incorrectly validates wildcard SSL     certificates containing literal IP addresses.

Updated curl packages fix security vulnerabilities :

Paras Sethia discovered that libcurl would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same server, sending requests for one user over the connection authenticated as a different user (CVE-2014-0015).

libcurl can in some circumstances re-use the wrong connection when asked to do transfers using other protocols than HTTP and FTP, causing a transfer that was initiated by an application to wrongfully re-use an existing connection to the same server that was authenticated using different credentials (CVE-2014-0138).

libcurl incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or just fool users into believing that it is a legitimate site (CVE-2014-0139).

In cURL before 7.38.0, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. For this problem to trigger, the client application must use the numerical IP address in the URL to access the site (CVE-2014-3613).

In cURL before 7.38.0, libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain (CVE-2014-3620).

Symeon Paraschoudis discovered that the curl_easy_duphandle() function in cURL has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending, while performing a HTTP POST operation. This bug requires CURLOPT_COPYPOSTFIELDS and curl_easy_duphandle() to be used in that order, and then the duplicate handle must be used to perform the HTTP POST. The curl command line tool is not affected by this problem as it does not use this sequence (CVE-2014-3707).

When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL (CVE-2014-8150).

Steve Holme discovered that libcurl incorrectly reused wrong connections when using protocols other than HTTP and FTP. This could lead to the use of unintended credentials, possibly exposing sensitive information. (CVE-2014-0138)

Richard Moore discovered that libcurl incorrectly validated wildcard SSL certificates that contain literal IP addresses. An attacker could possibly exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.
(CVE-2014-0139).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201406-21 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a man-in-the-middle attack via a crafted       certificate issued by a legitimate certification authority. Furthermore,       a context-dependent attacker may be able to bypass security restrictions       by connecting as other users.
  Workaround :

    There is no known workaround at this time.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap use-after-free flaw was found in curl versions     from 7.59.0 through 7.61.1 in the code related to     closing an easy handle. When closing and cleaning up an     'easy' handle in the `Curl_close()` function, the     library code first frees a struct (without nulling the     pointer) and might then subsequently erroneously write     to a struct field within that already freed     struct.(CVE-2018-16840)

  - cURL and libcurl 7.18.0 through 7.32.0, when built with     OpenSSL, disables the certificate CN and SAN name field     verification (CURLOPT_SSL_VERIFYHOST) when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid     certificate.(CVE-2013-4545)

  - The GnuTLS backend in libcurl 7.21.4 through 7.33.0,     when disabling digital signature verification     (CURLOPT_SSL_VERIFYPEER), also disables the     CURLOPT_SSL_VERIFYHOST check for CN or SAN host name     fields, which makes it easier for remote attackers to     spoof servers and conduct man-in-the-middle (MITM)     attacks.(CVE-2013-6422)

  - cURL and libcurl 7.1 before 7.36.0, when using the     OpenSSL, axtls, qsossl or gskit libraries for TLS,     recognize a wildcard IP address in the subject's Common     Name (CN) field of an X.509 certificate, which might     allow man-in-the-middle attackers to spoof arbitrary     SSL servers via a crafted certificate issued by a     legitimate Certification Authority.(CVE-2014-0139)

  - The (1) mbed_connect_step1 function in     lib/vtls/mbedtls.c and (2) polarssl_connect_step1     function in lib/vtls/polarssl.c in cURL and libcurl     before 7.49.0, when using SSLv3 or making a TLS     connection to a URL that uses a numerical IP address,     allow remote attackers to spoof servers via an     arbitrary valid certificate.(CVE-2016-3739)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Update to 7.37.0

    - Fixes CVE-2014-0138 and CVE-2014-0139 (RHBZ #1080880)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated lftp packages fix security vulnerability :

lftp incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or just fool users into believing that it is a legitimate site (CVE-2014-0139).

lftp was affected by this issue as it uses code from cURL for checking SSL certificates. The curl package was fixed in MDVSA-2015:098.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is prior to 7.2.6. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - HP SMH (XSRF)
    - libcurl
    - OpenSSL

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
218170	Linux Distros Unpatched Vulnerability : CVE-2014-0139	Nessus	Misc.	2025/3/4	2026/1/28	critical
73486	Debian DSA-2902-1 : curl - security update	Nessus	Debian Local Security Checks	2014/4/14	2021/1/11	medium
82351	Mandriva Linux Security Advisory : curl (MDVSA-2015:098)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	medium
73514	Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.10 : curl vulnerabilities (USN-2167-1)	Nessus	Ubuntu Local Security Checks	2014/4/15	2021/1/19	medium
76180	GLSA-201406-21 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/6/23	2021/1/6	medium
137468	EulerOS 2.0 SP2 : curl (EulerOS-SA-2020-1626)	Nessus	Huawei Local Security Checks	2020/6/17	2024/3/7	critical
74406	Fedora 20 : mingw-curl-7.37.0-1.fc20 (2014-6912)	Nessus	Fedora Local Security Checks	2014/6/10	2021/1/11	medium
74408	Fedora 19 : mingw-curl-7.37.0-1.fc19 (2014-6921)	Nessus	Fedora Local Security Checks	2014/6/10	2021/1/11	medium
83155	Mandriva Linux Security Advisory : lftp (MDVSA-2015:213)	Nessus	Mandriva Local Security Checks	2015/4/30	2021/1/14	medium
90251	HP System Management Homepage < 7.2.6 Multiple Vulnerabilities (FREAK)	Nessus	Web Servers	2016/3/29	2022/4/11	high

检测

插件搜索

critical

medium

medium

medium

medium

critical

medium

medium

medium

high