curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session. (CVE-2016-5419)

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.
(CVE-2016-5420)

libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
(CVE-2016-5421)

This update for curl fixes the following issues :

  - fixing a performance regression with FTP (boo#991746)

  - TLS session resumption client cert bypass (boo#991389,     CVE-2016-5419)

  - Re-using connections with wrong client cert (boo#991390,     CVE-2016-5420)

  - use of connection struct after free (boo#991391,     CVE-2016-5421)

The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppleGraphicsPowerManagement
  - Assets
  - Audio
  - Bluetooth
  - CoreCapture
  - CoreFoundation
  - CoreGraphics
  - CoreMedia External Displays
  - CoreMedia Playback
  - CoreStorage
  - CoreText
  - curl
  - Directory Services
  - Disk Images
  - FontParser
  - Foundation
  - Grapher
  - ICU
  - ImageIO
  - Intel Graphics Driver
  - IOFireWireFamily
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - IOSurface
  - Kernel
  - kext tools
  - libarchive
  - LibreSSL
  - OpenLDAP
  - OpenPAM
  - OpenSSL
  - Power Management
  - Security
  - syslog
  - WiFi
  - xar

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Furthermore, CVE-2016-6304, CVE-2016-7596, and CVE-2016-7604 also affect Mac OS X versions 10.10.5 and 10.11.6. However, this plugin does not check those versions.

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tenable Log Correlation Engine (LCE) installed on the remote host is prior to 4.8.1. It is, therefore, affected by the following vulnerabilities :

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the Handlebars library in the     lib/handlebars/utils.js script due to a failure to     properly escape input passed as unquoted attributes to     templates. An unauthenticated, remote attacker can     exploit these vulnerabilities, via a specially crafted     request, to execute arbitrary script code in a user's     browser session. (CVE-2015-8861, CVE-2015-8862)

  - A heap-based buffer overflow condition exists in the     Perl-Compatible Regular Expressions (PCRE) component     that is triggered when processing nested back references     in a duplicate named group. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1283)

  - An out-of-bounds read error exists in the libxml2     component in parserInternals.c due to improper parsing     of characters in an XML file. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1833)

  - An overflow condition exists in the libxml2 component in     xmlstring.c due to improper validation of user-supplied     input when handling a string with NULL. An     unauthenticated, remote attacker can exploit this, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1834)

  - Multiple use-after-free errors exist in the libxml2     component in parser.c that is triggered when parsing     complex names. An unauthenticated, remote attacker can     exploit these issues, via a specially crafted file, to     dereference already freed memory and potentially execute     arbitrary code. (CVE-2016-1835, CVE-2016-1836)

  - Multiple heap-based buffer overflow conditions exist in     the libxml2 component in HTMLparser.c and xmlregexp.c     due to improper validation of user-supplied input when     parsing characters in a range. An unauthenticated,     remote attacker can exploit these issues, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1837, CVE-2016-1839, CVE-2016-1840)

  - Multiple out-of-bounds read errors exist in the libxml2     component in parser.c. An unauthenticated, remote     attacker can exploit these issues to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1838, CVE-2016-4447)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncodeUpdate() function within file     crypto/evp/encode.c that is triggered when handling a     large amount of input data. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-2105)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncryptUpdate() function within     file crypto/evp/evp_enc.c that is triggered when     handling a large amount of input data after a previous     call occurs to the same function with a partial block.
    An unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2016-2106)

  - Flaws exist in the aesni_cbc_hmac_sha1_cipher()     function in file crypto/evp/e_aes_cbc_hmac_sha1.c and     the aesni_cbc_hmac_sha256_cipher() function in file     crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered     when the connection uses an AES-CBC cipher and AES-NI     is supported by the server. A man-in-the-middle attacker     can exploit these to conduct a padding oracle attack,     resulting in the ability to decrypt the network traffic.
    (CVE-2016-2107)

  - A remote code execution vulnerability exists in the     OpenSSL component in the ASN.1 encoder due to an     underflow condition that occurs when attempting to     encode the value zero represented as a negative integer.
    An unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code. (CVE-2016-2108)

  - Multiple unspecified flaws exist in the d2i BIO     functions when reading ASN.1 data from a BIO due to     invalid encoding causing a large allocation of memory.
    An unauthenticated, remote attacker can exploit these to     cause a denial of service condition through resource     exhaustion. (CVE-2016-2109)

  - An out-of-bounds read error exists in the     X509_NAME_oneline() function within file     crypto/x509/x509_obj.c when handling very long ASN1     strings. An unauthenticated, remote attacker can exploit     this to disclose the contents of stack memory.
    (CVE-2016-2176)

  - An overflow condition exists in the Perl-Compatible     Regular Expressions (PCRE) component due to improper     validation of user-supplied input when handling the     (*ACCEPT) verb. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2016-3191)

  - A flaw exists in the libxml2 component in parser.c that     occurs when handling XML content in recovery mode. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3627)

  - A flaw exists in the libxml2 component in parser.c due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3705)

  - A format string flaw exists in the libxml2 component due     to improper use of string format specifiers (e.g. %s and     %x). An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-4448)

  - An XML external entity injection vulnerability exists in     parser.c due to improper parsing of XML data. An     unauthenticated, remote attacker can exploit this, via     specially crafted XML data, to disclose arbitrary files     or cause a denial of service condition. (CVE-2016-4449)

  - An out-of-bounds read error exists in the libxml2     component in xmlsave.c that occurs when handling XML     content in recovery mode. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-4483)

  - A security bypass vulnerability exists in the libcurl     component due to the program attempting to resume TLS     sessions even if the client certificate fails. An     unauthenticated, remote attacker can exploit this to     bypass validation mechanisms. (CVE-2016-5419)

  - An information disclosure vulnerability exists in the     libcurl component due to the program reusing TLS     connections with different client certificates. An     unauthenticated, remote attacker can exploit this to     disclose sensitive cross-realm information.
    (CVE-2016-5420)

  - A use-after-free error exists in the libcurl component     that is triggered as connection pointers are not     properly cleared for easy handles. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, potentially resulting in the execution of     arbitrary code. (CVE-2016-5421)

  - Multiple stored cross-site scripting (XSS)   	vulnerabilities exist due to improper validation of   	user-supplied input. An authenticated, remote attacker   	can exploit these, via a specially crafted request, to   	execute arbitrary script code in a user's browsers   	session. (CVE-2016-9261)

Curl 安全团队报告：

CVE-2016-5419 - TLS 会话恢复客户端证书绕过

CVE-2016-5420 - 具有错误客户端证书的重复使用连接

CVE-2016-5421 - 释放后使用连接结构

- 修复以错误客户端证书重复使用连接的问题 (CVE-2016-5420)

- 修复 TLS 会话恢复客户端证书绕过问题 (CVE-2016-5419)

- 修复释放后使用连接结构的问题 (CVE-2016-5421)

请注意，Tenable Network Security 已直接从 Fedora 更新系统网站提取上述描述块。
Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

当客户端证书已变更时，curl 和低于 7.50.1 的 libcurl 并未阻止 TLS 会话恢复，远程攻击者可借此通过恢复会话绕过预期限制。(CVE-2016-5419)

当选择要重复使用的 TLS 连接时，curl 和低于 7.50.1 的 libcurl 并未检查客户端证书，这可能会允许远程攻击者通过利用先前使用不同客户端证书创建的连接，劫持连接的认证。
(CVE-2016-5420)

低于 7.50.1 版的 libcurl 允许攻击者控制要使用哪一个连接，或可能通过不明矢量造成其他不明影响。
(CVE-2016-5421)

此 curl 更新可修复下列问题：

- 修复 FTP 的一个性能回归 (boo#991746)

- TLS 会话恢复客户端证书绕过（boo#991389、CVE-2016-5419）

- 通过错误的客户端证书重复使用连接（boo#991390、CVE-2016-5420）

- 释放后使用连接结构（boo#991391、CVE-2016-5421）

远程主机正在运行的 macOS 版本为低于 10.12.2 的 10.12.x。因而会受到以下组件中的多个漏洞影响：- apache_mod_php - AppleGraphicsPowerManagement - Assets - Audio - Bluetooth - CoreCapture - CoreFoundation - CoreGraphics - CoreMedia External Displays - CoreMedia Playback - CoreStorage - CoreText - curl - Directory Services - Disk Images - FontParser - Foundation - Grapher - ICU - ImageIO - Intel Graphics Driver - IOFireWireFamily - IOAcceleratorFamily - IOHIDFamily - IOKit - IOSurface - Kernel - kext tools - libarchive - LibreSSL - OpenLDAP - OpenPAM - OpenSSL - Power Management - Security - syslog - WiFi - xar 请注意，如果成功利用最严重的问题则可能导致执行任意代码。此外，CVE-2016-6304、CVE-2016-7596 和 CVE-2016-7604 也会影响 Mac OS X 的 10.10.5 和 10.11.6 版本。但是，该插件并不检查这些版本。

远程主机上安装的 Tenable Log Correlation Engine (LCE) 版本低于 4.8.1。因而会受到以下漏洞的影响：- 由于未正确逃离作为模板的取消引用属性所传递的输入，Handlebars 库的 lib/handlebars/utils.js 脚本中存在多个跨站脚本 (XSS) 漏洞。未经身份验证的远程攻击者可利用这些漏洞，通过特制的请求，在用户浏览器会话中执行任意脚本代码。(CVE-2015-8861, CVE-2015-8862) - Perl-Compatible Regular Expressions (PCRE) 组件中存在基于堆的缓冲区溢出情况，处理复制命名群组中的嵌套向后引用时会触发。未经身份验证的远程攻击者可利用此问题造成拒绝服务情况或执行任意代码。(CVE-2016-1283) - 由于未正确分析 XML 文件中的字符，libxml2 组件的 parserInternals.c 中存在越界读取错误。未经身份验证的远程攻击者可利用此问题，泄露敏感信息或造成拒绝服务情况。(CVE-2016-1833) - 处理含有空值的字符串时，由于未正确验证用户提供的输入，libxml2 组件的 xmlstring.c 中存在溢出情况。未经身份验证的远程攻击者可利用此问题，通过特制的文件，造成拒绝服务情况或执行任意代码。(CVE-2016-1834) - libxml2 组件的 parser.c 中存在多个释放后使用错误，分析复杂名称时会触发。未经身份验证的远程攻击者可利用这些问题，通过特制的文件，取消引用已释放内存并可能执行任意代码。(CVE-2016-1835, CVE-2016-1836) - 分析某范围内的字符时，由于未正确验证用户提供的输入，libxml2 组件的 HTMLparser.c 和 xmlregexp.c 中存在多个基于堆缓冲区溢出情况。未经身份验证的远程攻击者可利用这些问题，通过特制的文件，造成拒绝服务情况或执行任意代码。(CVE-2016-1837, CVE-2016-1839, CVE-2016-1840) - libxml2 组件的 parser.c 中存在多个越界读取错误。未经身份验证的远程攻击者可利用这些问题，泄露敏感信息或造成拒绝服务情况。(CVE-2016-1838, CVE-2016-4447) - OpenSSL 组件中文件 crypto/evp/encode.c 内的 EVP_EncodeUpdate() 函数中存在堆缓冲区溢出情况，处理大量输入数据时会触发。未经身份验证的远程攻击者可利用此问题造成拒绝服务。(CVE-2016-2105) - OpenSSL 组件中文件 crypto/evp/evp_enc.c 内的 EVP_EncryptUpdate() 函数中存在堆缓冲区溢出情况，在前一次调用使用部分区块调用相同函数之后，处理大量输入数据时会触发。未经身份验证的远程攻击者可利用此问题造成拒绝服务。(CVE-2016-2106) - 文件 crypto/evp/e_aes_cbc_hmac_sha1.c 的 aesni_cbc_hmac_sha1_cipher() 函数和文件 crypto/evp/e_aes_cbc_hmac_sha256.c 的 aesni_cbc_hmac_sha256_cipher() 函数中存在多个缺陷，当连接使用 AES-CBC 密码且服务器支持 AES-NI 时会触发。中间人攻击者可利用这些漏洞，发动 padding oracle 攻击，进而解密网络流量。(CVE-2016-2107) - 尝试编码以负整数表示的零值时，由于发生下溢情况，OpenSSL 组件中的 ASN.1 编码器存在远程代码执行漏洞。未经身份验证的远程攻击者可利用此问题造成内存损坏，因此导致执行任意代码。(CVE-2016-2108) - 由于无效编码造成分配大量内存，当从 BIO 读取 ASN.1 数据时，d2i BIO 函数中存在多个不明缺陷。未经身份验证的远程攻击者可利用这些缺陷，通过资源耗尽造成拒绝服务情况。(CVE-2016-2109) - 处理极长的 ASN1 字符串时，crypto/x509/x509_obj.c 文件的 X509_NAME_oneline() 函数中存在越界读取错误。未经身份验证的远程攻击者可利用此错误泄露堆栈内存的内容。(CVE-2016-2176) - 处理 (*ACCEPT) 谓词时，由于未正确验证用户提供的输入，Perl-Compatible Regular Expressions (PCRE) 组件中存在溢出情况。未经身份验证的远程攻击者可利用此问题造成拒绝服务情况或执行任意代码。(CVE-2016-3191) - libxml2 组件的 parser.c 中存在缺陷，以恢复模式处理 XML 内容时会发生。未经身份验证的远程攻击者可利用此问题造成堆栈耗尽，从而导致拒绝服务情况。(CVE-2016-3627) - 由于未正确验证用户提供的输入，libxml2 组件的 parser.c 中存在缺陷。未经身份验证的远程攻击者可利用此问题造成堆栈耗尽，从而导致拒绝服务情况。(CVE-2016-3705) - 由于未正确使用字符串格式说明符（如 %s 和 %x），libxml2 组件中存在格式字符串缺陷。未经身份验证的远程攻击者可利用此问题造成拒绝服务情况或执行任意代码。(CVE-2016-4448) - 由于未正确分析 XML 数据，parser.c 中存在 XML 外部实体注入漏洞。未经身份验证的远程攻击者可利用此问题，通过特制的 XML 数据，泄露任意文件或造成拒绝服务情况。(CVE-2016-4449) - libxml2 组件的 xmlsave.c 中存在越界读取错误，以恢复模式处理 XML 内容时会发生。未经身份验证的远程攻击者可利用此问题，泄露敏感信息或造成拒绝服务情况。(CVE-2016-4483) - 由于即使客户端证书失败，程序还是会尝试恢复 TLS 会话，libcurl 组件中存在安全绕过漏洞。未经身份验证的远程攻击者可利用此问题绕过验证机制。(CVE-2016-5419) - 由于程序重复使用具有不同客户端证书的 TLS 连接，libcurl 组件中存在信息泄露漏洞。未经身份验证的远程攻击者可利用此问题，泄露敏感的跨域信息。(CVE-2016-5420) - libcurl 组件中存在释放后使用错误，未正确清除连接指针以便轻松处理时会触发。未经身份验证的远程攻击者可利用此问题取消引用已释放内存，从而导致执行任意代码。(CVE-2016-5421) - 由于未正确验证用户提供的输入，存在多种存储型跨站脚本 (XSS) 漏洞。经身份验证的远程攻击者可利用这些问题，通过特制的请求，在用户浏览器会话中执行任意脚本代码。(CVE-2016-9261)

Versions of cURL and libcurl prior to 7.50.1 are affected by multiple vulnerabilities :

 - A flaw exists in 'lib/vtls/vtls.c' due to the program attempting to resume TLS sessions even if the client certificate fails. This may allow a context-dependent attacker to bypass validation mechanisms. (CVE-2016-5419)
 - A use-after-free error exists in the 'close_all_connections()' function in 'lib/multi.c'. The issue is triggered as connection pointers are not properly cleared for easy handles. This may allow a context-dependent attacker to dereference already freed memory and have an unspecified impact that may potentially include code execution. (CVE-2016-5421)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
93008	Amazon Linux AMI : curl (ALAS-2016-730)	Nessus	Amazon Linux Local Security Checks	2016/8/18	2020/5/11	high
93334	openSUSE Security Update : curl (openSUSE-2016-1043)	Nessus	SuSE Local Security Checks	2016/9/6	2021/1/19	high
95917	macOS 10.12.x < 10.12.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2016/12/16	2020/1/7	high
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	critical
97893	Tenable Log Correlation Engine (LCE) < 4.8.1 Multiple Vulnerabilities	Nessus	Misc.	2017/3/22	2021/10/25	critical
92742	FreeBSD：Curl 中的漏洞 (e4bc70fc-5a2f-11e6-a1bc-589cfc0654e1)	Nessus	FreeBSD Local Security Checks	2016/8/5	2021/1/4	high
92990	Fedora 23：curl (2016-8354baae0f)	Nessus	Fedora Local Security Checks	2016/8/17	2021/1/11	high
93008	Amazon Linux AMI：curl (ALAS-2016-730)	Nessus	Amazon Linux Local Security Checks	2016/8/18	2020/5/11	high
93334	openSUSE 安全更新：curl (openSUSE-2016-1043)	Nessus	SuSE Local Security Checks	2016/9/6	2021/1/19	high
95917	macOS 10.12.x < 10.12.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2016/12/16	2020/1/7	high
97893	Tenable Log Correlation Engine (LCE) < 4.8.1 Multiple Vulnerabilities	Nessus	Misc.	2017/3/22	2021/10/25	critical
9764	cURL/libcurl 7.x < 7.50.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/11/11	2019/3/6	high

检测

插件搜索

high

high

high

critical

critical

high

high

high

high

high

critical

high