- Update to 7.37.0

    - Fixes CVE-2014-0138 and CVE-2014-0139 (RHBZ #1080880)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201406-21 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a man-in-the-middle attack via a crafted       certificate issued by a legitimate certification authority. Furthermore,       a context-dependent attacker may be able to bypass security restrictions       by connecting as other users.
  Workaround :

    There is no known workaround at this time.

The remote host has a version of IBM Rational ClearQuest 7.1.x prior to 7.1.2.16 / 8.0.0.x prior to 8.0.0.13 / 8.0.1.x prior to 8.0.1.6 installed. It is, therefore, potentially affected by multiple vulnerabilities in third party libraries :

  - An error exists in the libcURL and OpenSSL libraries     related to an IP address that uses a wildcard in the     subject's Common Name (CN) field of an X.509     certificate. A man-in-the-middle attacker can exploit     this issue to spoof SSL servers. (CVE-2014-0139)

  - An error exists in the OpenSSL library related to     'ec point format extension' handling and multithreaded     clients that allows freed memory to be overwritten     during a resumed session. (CVE-2014-3509)  
  - An error exists in the OpenSSL library related to     handling fragmented 'ClientHello' messages that allow a     man-in-the-middle attacker to force usage of TLS 1.0     regardless of higher protocol levels being supported by     both the server and the client. (CVE-2014-3511)

  - A man-in-the-middle (MitM) information disclosure     vulnerability known as POODLE. The vulnerability is due     to the way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. MitM attackers can decrypt a     selected byte of a cipher text in as few as 256 tries if     they are able to force a victim application to     repeatedly send the same data over newly created SSL 3.0     connections. (CVE-2014-3566)

  - An information disclosure flaw exists in the Java     library within the     'share/classes/sun/security/rsa/RSACore.java' class     related to 'RSA blinding' caused during operations using     private keys and measuring timing differences. This     allows a remote attacker to gain information about used     keys. (CVE-2014-4244)

  - A flaw exists in the Java library within the     'validateDHPublicKey' function in the     'share/classes/sun/security/util/KeyUtil.java' class     which is triggered during the validation of     Diffie-Hellman public key parameters. This allows a     remote attacker to recover a key. (CVE-2014-4263)

  - A NULL pointer dereference error exists in the OpenSSL     library related to handling Secure Remote Password     protocol (SRP) that allows a malicious server to crash a     client, resulting in a denial of service.
    (CVE-2014-5139)

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is prior to 7.2.6. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - HP SMH (XSRF)
    - libcurl
    - OpenSSL

根据安装的 curl 程序包版本，远程主机上安装的 EulerOS Virtualization 会受到下列漏洞影响：- 若是用 OpenSSL 建立，cURL 和 7.18.0 到 7.32.0 的 libcurl 会在停用数字签名验证 (CURLOPT_SSL_VERIFYPEER) 时，停用凭证 CN 和 SAN 名称字段验证 (CURLOPT_SSL_VERIFYHOST)，中间人攻击者因而得以通过任意的有效凭证伪造 SSL 服务器。(cve-2013-4545) - 停用数字签名验证 (CURLOPT_SSL_VERIFYPEER) 时，7.21.4 到 7.33.0 的 libcurl 中的 GnuTLS 后端也会停用对 CN 或 SAN 主机名字段的 CURLOPT_SSL_VERIFYHOST 检查，这让远程攻击者更易于伪造服务器及发动中间人 (MITM) 攻击。(cve-2013-6422) - 使用 OpenSSL、axtls、qsossl 或 TLS 的 gskit 库时，cURL 和 7.36.0 之前的 libcurl 7.1 会辨识 X.509 凭证的主体一般名称 (CN) 字段中的通配符 IP 地址，可能会允许中间人攻击者通过合法证书颁发机构单位核发的特制凭证伪造任意 SSL 服务器。(cve-2014-0139) - 若在 Windows 上执行且使用 SChannel/Winssl TLS 后端，curl 和 7.27.0 至 7.35.0 的 libcurl 不会在访问使用数字 IP 地址的 URL 时，确认服务器主机名是否与 X.509 凭证的主体一般名称 (CN) 或 subjectAltName 字段中的域名相符，允许中间人攻击者通过任意有效凭证伪造服务器。(CVE-2014-2522) - 在 curl 7.53.1 的 tool_writeout.c 中，ourWriteOut 函数可让实际位置靠近的攻击者在使用以“%”字符结尾的 --write-out 自变量期间读取工作站画面，进而在有机会的情况下，从进程内存获取敏感信息，进而导致基于堆的缓冲区过度读取。(CVE-2017-7407) - 据发现，curl 和 libcurl 可能会在收到 HTTP REDIRECT 回复时，将其验证标头发送给第三方 HTTP 服务器。这会将验证标记泄露至外部实体。(cve-2018-1000007) 请注意，Tenable Network Security 已直接从 EulerOS 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

- 更新到 7.37.0

- 修复 CVE-2014-0138 和 CVE-2014-0139 (RHBZ #1080880)

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

远程主机受到 GLSA-201406-21 中所述漏洞的影响（cURL：多个漏洞）

    已在 cURL 中发现多种漏洞。请检查下方引用的 CVE 标识符以了解详细信息。
  影响：

    远程攻击者可通过由合法证书颁发机构颁发的构建证书造成中间人攻击。此外，上下文有关的攻击者可能通过冒充其他用户进行连接，从而绕过安全限制。
  变通方案：

    目前无任何已知的变通方案。

根据 Web 服务器标题，远程 Web 服务器上托管的 HP System Management Homepage (SMH) 版本低于 7.2.6。因此，它受到多个组件与第三方库中的多种漏洞影响，包括远程代码执行漏洞：

- HP SMH (XSRF)
 - libcurl
 - OpenSSL

远程主机安装的 IBM Rational ClearQuest 7.1.x 低于 7.1.2.16，8.0.0.x 低于 8.0.0.13，8.0.1.x 低于 8.0.1.6。因此，它可能受到第三方库中库中多种漏洞的影响：

- libcURL 和 OpenSSL 库中存在一个与 IP 地址相关的错误，在 X.509 证书的主题公用名 (CN) 字段中使用通配符。中间人攻击者可利用此问题欺骗 SSL 服务器。(CVE-2014-0139)

- OpenSSL 库中存在一个与“ec point format extension”处理和多线程客户端相关的错误，在恢复会话时允许覆盖已释放内存。(CVE-2014-3509) 
 - OpenSSL 库中存在一个与处理拆分的“ClientHello”消息相关的错误，允许中间人攻击者不管服务器和客户端是否支持更高协议级别而强制使用 TLS 1.0。(CVE-2014-3511)

- 称为 POODLE 的中间人 (MitM) 信息泄露漏洞。该漏洞是由于 SSL 3.0 解密使用密码块链接 (CBC) 模式中的块密码进行加密的消息时采用的处理填充字节的方式所引起。如果 MitM 攻击者能够强制受害的应用程序通过新创建的 SSL 3.0 连接不断发送同样的数据，就能将选中的加密文本字节在 256 次内解密。(CVE-2014-3566)

-“share/classes/sun/security/rsa/RSACore.java”类内的 Java 库中存在一个与“RSA 伪装”相关的信息泄露缺陷，在使用私钥和测量时间性差异的操作期间会造成该缺陷。这允许远程攻击者获取关于使用的密钥的信息。(CVE-2014-4244)

- 在“share/classes/sun/security/util/KeyUtil.java”类中的“validateDHPublicKey”函数内的 Java 库中存在缺陷，此缺陷会在验证 Diffie-Hellman 公钥参数期间触发。这允许远程攻击者恢复密钥。(CVE-2014-4263)

- OpenSSL 库中存在一个与处理安全远程密码协议 (SRP) 相关的空指针取消引用错误，可允许恶意服务器造成客户端崩溃，从而导致拒绝服务。
 (CVE-2014-5139)

Versions of cURL/libcURL older than 7.35.0 are unpatched for the following vulnerabilities:

  - Security-bypass vulnerability because recent authenticated connections are allowed to be re-used, which an attacker can leverage to perform certain operations with the credentials of a recently authenticated user. (CVE-2014-0138)

  - SSL certificate validation error wherein an IP address containing wildcard characters within the Common Name field is not properly validated; this can be leveraged for man-in-the-middle attacks or trusted server impersonation. (CVE-2014-0139)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
74406	Fedora 20 : mingw-curl-7.37.0-1.fc20 (2014-6912)	Nessus	Fedora Local Security Checks	2014/6/10	2021/1/11	medium
76180	GLSA-201406-21 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/6/23	2021/1/6	medium
81784	IBM Rational ClearQuest 7.1.x < 7.1.2.16 / 8.0.0.x < 8.0.0.13 / 8.0.1.x < 8.0.1.6 Multiple Vulnerabilities (credentialed check) (POODLE)	Nessus	Windows	2015/3/12	2023/6/23	low
90251	HP System Management Homepage < 7.2.6 Multiple Vulnerabilities (FREAK)	Nessus	Web Servers	2016/3/29	2022/4/11	high
123858	EulerOS Virtualization 2.5.3：curl (EulerOS-SA-2019-1172)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/4	critical
74406	Fedora 20：mingw-curl-7.37.0-1.fc20 (2014-6912)	Nessus	Fedora Local Security Checks	2014/6/10	2021/1/11	medium
76180	GLSA-201406-21 : cURL：多个漏洞	Nessus	Gentoo Local Security Checks	2014/6/23	2021/1/6	medium
90251	HP System Management Homepage < 7.2.6 多种漏洞 (FREAK)	Nessus	Web Servers	2016/3/29	2022/4/11	high
81784	IBM Rational ClearQuest 7.1.x < 7.1.2.16 / 8.0.0.x < 8.0.0.13 / 8.0.1.x < 8.0.1.6 多种漏洞（凭据检查）(POODLE)	Nessus	Windows	2015/3/12	2023/6/23	low
8178	cURL/libcURL 7.x < 7.35.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2014/3/31	2019/3/6	medium

检测

插件搜索

medium

medium

low

high

critical

medium

medium

high

low

medium