The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3805-1 advisory.

    Harry Sintonen discovered that curl incorrectly handled SASL authentication. A remote attacker could use     this issue to cause curl to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2018-16839)

    Brian Carpenter discovered that curl incorrectly handled memory when closing certain handles. A remote     attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly     execute arbitrary code. (CVE-2018-16840)

    Brian Carpenter discovered that the curl command-line tool incorrectly handled error messages. A remote     attacker could possibly use this issue to obtain sensitive information. (CVE-2018-16842)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities were discovered in cURL, an URL transfer library.

  - CVE-2018-16839     Harry Sintonen discovered that, on systems with a 32 bit     size_t, an integer overflow would be triggered when a     SASL user name longer than 2GB is used. This would in     turn cause a very small buffer to be allocated instead     of the intended very huge one, which would trigger a     heap buffer overflow when the buffer is used.

  - CVE-2018-16842     Brian Carpenter discovered that the logic in the curl     tool to wrap error messages at 80 columns is flawed,     leading to a read buffer overflow if a single word in     the message is itself longer than 80 bytes.

An update of the curl package has been released.

curl security problems :

CVE-2018-16839: SASL password overflow via integer overflow

libcurl contains a buffer overrun in the SASL authentication code.

The internal function Curl_auth_create_plain_message fails to correctly verify that the passed in lengths for name and password aren't too long, then calculates a buffer size to allocate.

On systems with a 32 bit size_t, the math to calculate the buffer size triggers an integer overflow when the user name length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow.

This bug is very similar to CVE-2017-14618.

It affects curl 7.33.0 to 7.61.1.

CVE-2018-16840: use-after-free in handle close

libcurl contains a heap use-after-free flaw in code related to closing an easy handle.

When closing and cleaning up an 'easy' handle in the Curl_close() function, the library code first frees a struct (without nulling the pointer) and might then subsequently erroneously write to a struct field within that already freed struct.

It affects curl 7.59.0 to 7.61.1.

CVE-2018-16842: warning message out-of-buffer read

curl contains a heap out of buffer read vulnerability.

The command line tool has a generic function for displaying warning and informational messages to stderr for various situations. For example if an unknown command line argument is used, or passed to it in a 'config' file.

This display function formats the output to wrap at 80 columns. The wrap logic is however flawed, so if a single word in the message is itself longer than 80 bytes the buffer arithmetic calculates the remainder wrong and will end up reading behind the end of the buffer.
This could lead to information disclosure or crash.

This vulnerability could lead to a security issue if used in this or similar situations :

1. a server somewhere uses the curl command line to run something

2. if it fails, it shows stderr to the user

3. the server takes user input for parts of its command line input

4. user provides something overly long that triggers this crash

5. the stderr output may now contain user memory contents that wasn't meant to be available

It affects curl 7.14.1 to 7.61.1.

This update for curl fixes the following issues :

  - CVE-2018-16839: A SASL password overflow via integer     overflow was fixed which could lead to crashes     (bsc#1112758)

  - CVE-2018-16840: A use-after-free in SASL handle close     was fixed which could lead to crashes (bsc#1112758)

  - CVE-2018-16842: A Out-of-bounds Read in tool_msgs.c was     fixed which could lead to crashes (bsc#1113660)

This update was imported from the SUSE:SLE-15:Update update project.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
118591	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : curl vulnerabilities (USN-3805-1)	Nessus	Ubuntu Local Security Checks	2018/11/1	2024/8/27	critical
118720	Debian DSA-4331-1 : curl - security update	Nessus	Debian Local Security Checks	2018/11/5	2024/7/26	critical
122898	Photon OS 1.0: Curl PHSA-2019-1.0-0205	Nessus	PhotonOS Local Security Checks	2019/3/18	2024/6/13	critical
118707	FreeBSD : curl -- multiple vulnerabilities (e0ab1773-07c1-46c6-9170-4c5e81c00927)	Nessus	FreeBSD Local Security Checks	2018/11/2	2022/1/31	critical
118876	openSUSE Security Update : curl (openSUSE-2018-1379)	Nessus	SuSE Local Security Checks	2018/11/11	2024/7/24	critical

检测

插件搜索

critical

critical

critical

critical

critical