This update for curl fixes the following issues :

  - CVE-2017-1000100: TFP sends more than buffer size and it     could lead to a denial of service (bsc#1051644)

  - CVE-2017-1000101: URL globbing out of bounds read could     lead to a denial of service (bsc#1051643)

This update was imported from the SUSE:SLE-12:Update update project.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3441-1 advisory.

    Daniel Stenberg discovered that curl incorrectly handled large floating point output. A remote attacker     could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-9586)

    Even Rouault discovered that curl incorrectly handled large file names when doing TFTP transfers. A remote     attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain     sensitive memory contents. (CVE-2017-1000100)

    Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handled numerical range globbing. A     remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly     obtain sensitive memory contents. (CVE-2017-1000101)

    Max Dymond discovered that curl incorrectly handled FTP PWD responses. A remote attacker could use this     issue to cause curl to crash, resulting in a denial of service. (CVE-2017-1000254)

    Brian Carpenter discovered that curl incorrectly handled the --write-out command line option. A local     attacker could possibly use this issue to obtain sensitive memory contents. (CVE-2017-7407)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a CWE-126: Buffer Over-read vulnerability in     denial of service that can result in curl can be     tricked into reading data beyond the end of a heap     based buffer used to store downloaded RTSP     content..(CVE-2018-1000301)

  - It was found that the libcurl library did not check the     client certificate when choosing the TLS connection to     reuse. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate.(CVE-2016-5420)

  - It was discovered that libcurl could incorrectly reuse     NTLM-authenticated connections for subsequent     unauthenticated requests to the same host. If an     application using libcurl established an     NTLM-authenticated connection to a server, and sent     subsequent unauthenticated requests to the same server,     the unauthenticated requests could be sent over the     NTLM-authenticated connection, appearing as if they     were sent by the NTLM authenticated     user.(CVE-2015-3143)

  - libcurl may read outside of a heap allocated buffer     when doing FTP. When libcurl connects to an FTP server     and successfully logs in (anonymous or not), it asks     the server for the current directory with the `PWD`     command. The server then responds with a 257 response     containing the path, inside double quotes. The returned     path name is then kept by libcurl for subsequent uses.
    Due to a flaw in the string parser for this directory     name, a directory name passed like this but without a     closing double quote would lead to libcurl not adding a     trailing NUL byte to the buffer holding the name. When     libcurl would then later access the string, it could     read beyond the allocated heap buffer and crash or     wrongly access data beyond the buffer, thinking it was     part of the path. A malicious server could abuse this     fact and effectively prevent libcurl-based clients to     work with it - the PWD command is always issued on new     FTP connections and the mistake has a high chance of     causing a segfault. The simple fact that this has issue     remained undiscovered for this long could suggest that     malformed PWD responses are rare in benign servers. We     are not aware of any exploit of this flaw. This bug was     introduced in commit     415d2e7cb7(https://github.com/curl/curl/commit/415d2e7c     b7), March 2005. In libcurl version 7.56.0, the parser     always zero terminates the string but also rejects it     if not terminated properly with a final double     quote.(CVE-2017-1000254)

  - It was discovered that libcurl could incorrectly reuse     Negotiate authenticated HTTP connections for subsequent     requests. If an application using libcurl established a     Negotiate authenticated HTTP connection to a server and     sent subsequent requests with different credentials,     the connection could be re-used with the initial set of     credentials instead of using the new     ones.(CVE-2015-3148)

  - Heap-based buffer overflow in the curl_easy_unescape     function in lib/escape.c in cURL and libcurl 7.7     through 7.30.0 allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via a crafted string ending in a     ''%'' (percent) character.(CVE-2013-2174)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8616)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8619)

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external     entities.(CVE-2018-1000007)

  - A flaw was found in the way the libcurl library     performed the duplication of connection handles. If an     application set the CURLOPT_COPYPOSTFIELDS option for a     handle, using the handle's duplicate could cause the     application to crash or disclose a portion of its     memory.(CVE-2014-3707)

  - Multiple integer overflow flaws leading to heap-based     buffer overflows were found in the way curl handled     escaping and unescaping of data. An attacker could     potentially use these flaws to crash an application     using libcurl by sending a specially crafted input to     the affected libcurl functions.(CVE-2016-7167)

  - When doing a TFTP transfer and curl/libcurl is given a     URL that contains a very long file name (longer than     about 515 bytes), the file name is truncated to fit     within the buffer boundaries, but the buffer size is     still wrongly updated to use the untruncated length.
    This too large value is then used in the sendto() call,     making curl attempt to send more data than what is     actually put into the buffer. The endto() function will     then read beyond the end of the heap based buffer. A     malicious HTTP(S) server could redirect a vulnerable     libcurl-using client to a crafted TFTP URL (if the     client hasn't restricted which protocols it allows     redirects to) and trick it to send private memory     contents to a remote server over UDP. Limit curl's     redirect protocols with --proto-redir and libcurl's     with CURLOPT_REDIR_PROTOCOLS.(CVE-2017-1000100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-1000100     Even Rouault reported that cURL does not properly handle     long file names when doing an TFTP upload. A malicious     HTTP(S) server can take advantage of this flaw by     redirecting a client using the cURL library to a crafted     TFTP URL and trick it to send private memory contents to     a remote server over UDP.

  - CVE-2017-1000101     Brian Carpenter and Yongji Ouyang reported that cURL     contains a flaw in the globbing function that parses the     numerical range, leading to an out-of-bounds read when     parsing a specially crafted URL.

  - CVE-2017-1000254     Max Dymond reported that cURL contains an out-of-bounds     read flaw in the FTP PWD response parser. A malicious     server can take advantage of this flaw to effectively     prevent a client using the cURL library to work with it,     causing a denial of service.

远程主机受到 GLSA-201709-14 中所述漏洞的影响（cURL：多个漏洞）在 cURL 中发现多个漏洞。请检查下面引用的 CVE 标识符以了解详细信息。影响：远程攻击者可造成拒绝服务、取得敏感信息或绕过 TLS 会话的预定限制。解决方法：目前无任何已知的解决方法。

根据安装的 curl 程序包版本，远程主机上安装的 EulerOS Virtualization 会受到下列漏洞影响：- 执行 TFTP 传输且为 curl/libcurl 提供含有极长文件名（大约比 515 字节长）的 URL 时，文件名会遭到截断，以适合缓冲区边界，但缓冲区大小的更新方式仍然有误，无法使用截断后的长度。而后，这个过大的值会用于 sendto() 调用，让 curl 尝试发送比实际置入缓冲区的数据量更多的数据。然后 endto() 函数的读取范围会超过基于堆的缓冲区的终点。恶意的 HTTP(S) 服务器可将使用 libcurl 的易受影响客户端重定向到特制的 TFTP URL（若该客户端尚未对允许重定向到哪些协议设限），并诱骗客户端通过 UDP 发送私密内存内容到远程服务器。用 --proto-redir 限制 curl 的重定向协议，并用 CURLOPT_REDIR_PROTOCOLS 限制 libcurl 的重定向协议。(cve-2017-1000100) 请注意，Tenable Network Security 已直接从 EulerOS 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

CVE-2017-1000100 TFTP 期间错误处理超长文件名可导致 curl 发送超过缓冲区大小。对于 Debian 7“Wheezy”，已在版本 7.26.0-1+wheezy20 中修复了此问题。建议您升级 curl 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

根据安装的 curl 程序包版本，远程主机上安装的 EulerOS Virtualization 会受到下列漏洞影响：- 执行 TFTP 传输且为 curl/libcurl 提供含有极长文件名（大约比 515 字节长）的 URL 时，文件名会遭到截断，以适合缓冲区边界，但缓冲区大小的更新方式仍然有误，无法使用截断后的长度。而后，这个过大的值会用于 sendto() 调用，让 curl 尝试发送比实际置入缓冲区的数据量更多的数据。然后 endto() 函数的读取范围会超过基于堆的缓冲区的终点。恶意的 HTTP(S) 服务器可将使用 libcurl 的易受影响客户端重定向到特制的 TFTP URL（若该客户端尚未对允许重定向到哪些协议设限），并诱骗客户端通过 UDP 发送私密内存内容到远程服务器。用 --proto-redir 限制 curl 的重定向协议，并用 CURLOPT_REDIR_PROTOCOLS 限制 libcurl 的重定向协议。(CVE-2017-1000100) - 据发现，curl 和 libcurl 可能会在收到 HTTP REDIRECT 回复时，将其验证标头发送给第三方 HTTP 服务器。这会将验证标记泄露至外部实体。(CVE-2018-1000007) 请注意，Tenable Network Security 已直接从 EulerOS 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

The remote host is affected by the vulnerability described in GLSA-201709-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition, obtain       sensitive information, or bypass intended restrictions for TLS sessions.
  Workaround :

    There is no known workaround at this time.

An update of [go,curl,libtiff,systemd,bash] packages for PhotonOS has been released.

According to the version of the curl package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - When doing a TFTP transfer and curl/libcurl is given a     URL that contains a very long file name (longer than     about 515 bytes), the file name is truncated to fit     within the buffer boundaries, but the buffer size is     still wrongly updated to use the untruncated length.
    This too large value is then used in the sendto() call,     making curl attempt to send more data than what is     actually put into the buffer. The endto() function will     then read beyond the end of the heap based buffer. A     malicious HTTP(S) server could redirect a vulnerable     libcurl-using client to a crafted TFTP URL (if the     client hasn't restricted which protocols it allows     redirects to) and trick it to send private memory     contents to a remote server over UDP. Limit curl's     redirect protocols with --proto-redir and libcurl's     with CURLOPT_REDIR_PROTOCOLS.(CVE-2017-1000100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - When doing a TFTP transfer and curl/libcurl is given a     URL that contains a very long file name (longer than     about 515 bytes), the file name is truncated to fit     within the buffer boundaries, but the buffer size is     still wrongly updated to use the untruncated length.
    This too large value is then used in the sendto() call,     making curl attempt to send more data than what is     actually put into the buffer. The endto() function will     then read beyond the end of the heap based buffer. A     malicious HTTP(S) server could redirect a vulnerable     libcurl-using client to a crafted TFTP URL (if the     client hasn't restricted which protocols it allows     redirects to) and trick it to send private memory     contents to a remote server over UDP. Limit curl's     redirect protocols with --proto-redir and libcurl's     with CURLOPT_REDIR_PROTOCOLS.i1/4^CVE-2017-1000100i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-1000100 Wrong handling of very long filenames during TFTP might result in curl sending more than buffer size.

For Debian 7 'Wheezy', this problem has been fixed in version 7.26.0-1+wheezy20.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - When doing a TFTP transfer and curl/libcurl is given a     URL that contains a very long file name (longer than     about 515 bytes), the file name is truncated to fit     within the buffer boundaries, but the buffer size is     still wrongly updated to use the untruncated length.
    This too large value is then used in the sendto() call,     making curl attempt to send more data than what is     actually put into the buffer. The endto() function will     then read beyond the end of the heap based buffer. A     malicious HTTP(S) server could redirect a vulnerable     libcurl-using client to a crafted TFTP URL (if the     client hasn't restricted which protocols it allows     redirects to) and trick it to send private memory     contents to a remote server over UDP. Limit curl's     redirect protocols with --proto-redir and libcurl's     with CURLOPT_REDIR_PROTOCOLS.i1/4^CVE-2017-1000100i1/4%0

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external     entities.i1/4^CVE-2018-1000007i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues :

  - CVE-2017-1000100: TFP sends more than buffer size and it     could lead to a denial of service (bsc#1051644)

  - CVE-2017-7407: ourWriteOut function problem could lead     to a heap buffer over-read (bsc#1032309)

  - CVE-2016-9586: libcurl printf issue could lead to buffer     overflow (bsc#1015332)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of [systemd,curl,glibc,freetype2] packages for PhotonOS has been released.

The remote host is running a version of Mac OS X that is 10.13.x prior to 10.13.1. It is, therefore, affected by multiple vulnerabilities in the following components :

 - APFS
 - curl
 - Dictionary Widget
 - Kernel
 - StreamingZip
 - tcpdump
 - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
102566	openSUSE Security Update : curl (openSUSE-2017-951)	Nessus	SuSE Local Security Checks	2017/8/18	2021/1/19	medium
103773	Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerabilities (USN-3441-1)	Nessus	Ubuntu Local Security Checks	2017/10/11	2025/9/3	high
125003	EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1550)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical
103715	Debian DSA-3992-1 : curl - security update	Nessus	Debian Local Security Checks	2017/10/9	2021/1/4	high
103282	GLSA-201709-14：cURL：多个漏洞	Nessus	Gentoo Local Security Checks	2017/9/18	2021/1/11	high
123849	EulerOS Virtualization 2.5.3：curl (EulerOS-SA-2019-1163)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/5	medium
102597	Debian DLA-1062-1：curl 安全更新	Nessus	Debian Local Security Checks	2017/8/21	2021/1/11	medium
123892	EulerOS Virtualization 2.5.4：curl (EulerOS-SA-2019-1206)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/4	critical
103282	GLSA-201709-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2017/9/18	2021/1/11	high
111894	Photon OS 2.0: Bash / Curl / Go / Libtiff / Systemd PHSA-2017-0045 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	critical
122705	EulerOS Virtualization 2.5.2 : curl (EulerOS-SA-2019-1083)	Nessus	Huawei Local Security Checks	2019/3/8	2024/6/14	medium
123849	EulerOS Virtualization 2.5.3 : curl (EulerOS-SA-2019-1163)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/5	medium
102597	Debian DLA-1062-1 : curl security update	Nessus	Debian Local Security Checks	2017/8/21	2021/1/11	medium
123892	EulerOS Virtualization 2.5.4 : curl (EulerOS-SA-2019-1206)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/4	critical
102910	SUSE SLES11 Security Update : curl (SUSE-SU-2017:2312-1)	Nessus	SuSE Local Security Checks	2017/9/1	2021/1/19	high
111890	Photon OS 1.0: Curl / Freetype2 / Glibc / Systemd PHSA-2017-0041 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	critical
700512	macOS 10.13.x < 10.13.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2019/4/10	2019/4/10	critical

检测

插件搜索

medium

high

critical

high

high

medium

medium

critical

high

critical

medium

medium

medium

critical

high

critical

critical