New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

This update for curl fixes the following issues :

  - CVE-2017-1000100: TFP sends more than buffer size and it     could lead to a denial of service (bsc#1051644)

  - CVE-2017-1000101: URL globbing out of bounds read could     lead to a denial of service (bsc#1051643)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-1000100     Even Rouault reported that cURL does not properly handle     long file names when doing an TFTP upload. A malicious     HTTP(S) server can take advantage of this flaw by     redirecting a client using the cURL library to a crafted     TFTP URL and trick it to send private memory contents to     a remote server over UDP.

  - CVE-2017-1000101     Brian Carpenter and Yongji Ouyang reported that cURL     contains a flaw in the globbing function that parses the     numerical range, leading to an out-of-bounds read when     parsing a specially crafted URL.

  - CVE-2017-1000254     Max Dymond reported that cURL contains an out-of-bounds     read flaw in the FTP PWD response parser. A malicious     server can take advantage of this flaw to effectively     prevent a client using the cURL library to work with it,     causing a denial of service.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3441-1 advisory.

    Daniel Stenberg discovered that curl incorrectly handled large floating point output. A remote attacker     could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-9586)

    Even Rouault discovered that curl incorrectly handled large file names when doing TFTP transfers. A remote     attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain     sensitive memory contents. (CVE-2017-1000100)

    Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handled numerical range globbing. A     remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly     obtain sensitive memory contents. (CVE-2017-1000101)

    Max Dymond discovered that curl incorrectly handled FTP PWD responses. A remote attacker could use this     issue to cause curl to crash, resulting in a denial of service. (CVE-2017-1000254)

    Brian Carpenter discovered that curl incorrectly handled the --write-out command line option. A local     attacker could possibly use this issue to obtain sensitive memory contents. (CVE-2017-7407)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

远程主机受到 GLSA-201709-14 中所述漏洞的影响（cURL：多个漏洞）在 cURL 中发现多个漏洞。请检查下面引用的 CVE 标识符以了解详细信息。影响：远程攻击者可造成拒绝服务、取得敏感信息或绕过 TLS 会话的预定限制。解决方法：目前无任何已知的解决方法。

CVE-2017-1000100 TFTP 期间错误处理超长文件名可导致 curl 发送超过缓冲区大小。对于 Debian 7“Wheezy”，已在版本 7.26.0-1+wheezy20 中修复了此问题。建议您升级 curl 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

根据安装的 curl 程序包版本，远程主机上安装的 EulerOS Virtualization 会受到下列漏洞影响：- 执行 TFTP 传输且为 curl/libcurl 提供含有极长文件名（大约比 515 字节长）的 URL 时，文件名会遭到截断，以适合缓冲区边界，但缓冲区大小的更新方式仍然有误，无法使用截断后的长度。而后，这个过大的值会用于 sendto() 调用，让 curl 尝试发送比实际置入缓冲区的数据量更多的数据。然后 endto() 函数的读取范围会超过基于堆的缓冲区的终点。恶意的 HTTP(S) 服务器可将使用 libcurl 的易受影响客户端重定向到特制的 TFTP URL（若该客户端尚未对允许重定向到哪些协议设限），并诱骗客户端通过 UDP 发送私密内存内容到远程服务器。用 --proto-redir 限制 curl 的重定向协议，并用 CURLOPT_REDIR_PROTOCOLS 限制 libcurl 的重定向协议。(cve-2017-1000100) 请注意，Tenable Network Security 已直接从 EulerOS 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

根据安装的 curl 程序包版本，远程主机上安装的 EulerOS Virtualization 会受到下列漏洞影响：- 执行 TFTP 传输且为 curl/libcurl 提供含有极长文件名（大约比 515 字节长）的 URL 时，文件名会遭到截断，以适合缓冲区边界，但缓冲区大小的更新方式仍然有误，无法使用截断后的长度。而后，这个过大的值会用于 sendto() 调用，让 curl 尝试发送比实际置入缓冲区的数据量更多的数据。然后 endto() 函数的读取范围会超过基于堆的缓冲区的终点。恶意的 HTTP(S) 服务器可将使用 libcurl 的易受影响客户端重定向到特制的 TFTP URL（若该客户端尚未对允许重定向到哪些协议设限），并诱骗客户端通过 UDP 发送私密内存内容到远程服务器。用 --proto-redir 限制 curl 的重定向协议，并用 CURLOPT_REDIR_PROTOCOLS 限制 libcurl 的重定向协议。(CVE-2017-1000100) - 据发现，curl 和 libcurl 可能会在收到 HTTP REDIRECT 回复时，将其验证标头发送给第三方 HTTP 服务器。这会将验证标记泄露至外部实体。(CVE-2018-1000007) 请注意，Tenable Network Security 已直接从 EulerOS 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

According to the version of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - When doing a TFTP transfer and curl/libcurl is given a     URL that contains a very long file name (longer than     about 515 bytes), the file name is truncated to fit     within the buffer boundaries, but the buffer size is     still wrongly updated to use the untruncated length.
    This too large value is then used in the sendto() call,     making curl attempt to send more data than what is     actually put into the buffer. The endto() function will     then read beyond the end of the heap based buffer. A     malicious HTTP(S) server could redirect a vulnerable     libcurl-using client to a crafted TFTP URL (if the     client hasn't restricted which protocols it allows     redirects to) and trick it to send private memory     contents to a remote server over UDP. Limit curl's     redirect protocols with --proto-redir and libcurl's     with CURLOPT_REDIR_PROTOCOLS.i1/4^CVE-2017-1000100i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - When doing a TFTP transfer and curl/libcurl is given a     URL that contains a very long file name (longer than     about 515 bytes), the file name is truncated to fit     within the buffer boundaries, but the buffer size is     still wrongly updated to use the untruncated length.
    This too large value is then used in the sendto() call,     making curl attempt to send more data than what is     actually put into the buffer. The endto() function will     then read beyond the end of the heap based buffer. A     malicious HTTP(S) server could redirect a vulnerable     libcurl-using client to a crafted TFTP URL (if the     client hasn't restricted which protocols it allows     redirects to) and trick it to send private memory     contents to a remote server over UDP. Limit curl's     redirect protocols with --proto-redir and libcurl's     with CURLOPT_REDIR_PROTOCOLS.i1/4^CVE-2017-1000100i1/4%0

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external     entities.i1/4^CVE-2018-1000007i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the curl package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - When doing a TFTP transfer and curl/libcurl is given a     URL that contains a very long file name (longer than     about 515 bytes), the file name is truncated to fit     within the buffer boundaries, but the buffer size is     still wrongly updated to use the untruncated length.
    This too large value is then used in the sendto() call,     making curl attempt to send more data than what is     actually put into the buffer. The endto() function will     then read beyond the end of the heap based buffer. A     malicious HTTP(S) server could redirect a vulnerable     libcurl-using client to a crafted TFTP URL (if the     client hasn't restricted which protocols it allows     redirects to) and trick it to send private memory     contents to a remote server over UDP. Limit curl's     redirect protocols with --proto-redir and libcurl's     with CURLOPT_REDIR_PROTOCOLS.(CVE-2017-1000100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues :

  - CVE-2017-1000100: TFP sends more than buffer size and it     could lead to a denial of service (bsc#1051644)

  - CVE-2017-7407: ourWriteOut function problem could lead     to a heap buffer over-read (bsc#1032309)

  - CVE-2016-9586: libcurl printf issue could lead to buffer     overflow (bsc#1015332)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201709-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition, obtain       sensitive information, or bypass intended restrictions for TLS sessions.
  Workaround :

    There is no known workaround at this time.

CVE-2017-1000100 Wrong handling of very long filenames during TFTP might result in curl sending more than buffer size.

For Debian 7 'Wheezy', this problem has been fixed in version 7.26.0-1+wheezy20.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of [go,curl,libtiff,systemd,bash] packages for PhotonOS has been released.

An update of [systemd,curl,glibc,freetype2] packages for PhotonOS has been released.

The remote host is running a version of Mac OS X that is 10.13.x prior to 10.13.1. It is, therefore, affected by multiple vulnerabilities in the following components :

 - APFS
 - curl
 - Dictionary Widget
 - Kernel
 - StreamingZip
 - tcpdump
 - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102365	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : curl (SSA:2017-221-01)	Nessus	Slackware Local Security Checks	2017/8/11	2021/1/14	medium
102540	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:2174-1)	Nessus	SuSE Local Security Checks	2017/8/17	2021/1/6	medium
103715	Debian DSA-3992-1 : curl - security update	Nessus	Debian Local Security Checks	2017/10/9	2021/1/4	high
103773	Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerabilities (USN-3441-1)	Nessus	Ubuntu Local Security Checks	2017/10/11	2025/9/3	high
103282	GLSA-201709-14：cURL：多个漏洞	Nessus	Gentoo Local Security Checks	2017/9/18	2021/1/11	high
102597	Debian DLA-1062-1：curl 安全更新	Nessus	Debian Local Security Checks	2017/8/21	2021/1/11	medium
123849	EulerOS Virtualization 2.5.3：curl (EulerOS-SA-2019-1163)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/5	medium
123892	EulerOS Virtualization 2.5.4：curl (EulerOS-SA-2019-1206)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/4	critical
123849	EulerOS Virtualization 2.5.3 : curl (EulerOS-SA-2019-1163)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/5	medium
123892	EulerOS Virtualization 2.5.4 : curl (EulerOS-SA-2019-1206)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/4	critical
122705	EulerOS Virtualization 2.5.2 : curl (EulerOS-SA-2019-1083)	Nessus	Huawei Local Security Checks	2019/3/8	2024/6/14	medium
102910	SUSE SLES11 Security Update : curl (SUSE-SU-2017:2312-1)	Nessus	SuSE Local Security Checks	2017/9/1	2021/1/19	high
103282	GLSA-201709-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/9/18	2021/1/11	high
102597	Debian DLA-1062-1 : curl security update	Nessus	Debian Local Security Checks	2017/8/21	2021/1/11	medium
111894	Photon OS 2.0: Bash / Curl / Go / Libtiff / Systemd PHSA-2017-0045 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	critical
111890	Photon OS 1.0: Curl / Freetype2 / Glibc / Systemd PHSA-2017-0041 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	critical
700512	macOS 10.13.x < 10.13.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2019/4/10	2019/4/10	critical

检测

插件搜索

medium

medium

high

high

high

medium

medium

critical

medium

critical

medium

high

high

medium

critical

critical

critical