遠端 Oracle Linux 8 主機中安裝的套件受到 ELSA-2019-3701 公告中提及的多個弱點影響。

  - 在 GNU Wget 1.20.1 之前版本中，xattr.c 的 set_file_metadata 會將檔案的來源 URL 儲存在已下載檔案之延伸屬性的 user.xdg.origin.url 中繼資料屬性中，因而本機使用者可透過讀取此屬性來取得敏感資訊 (例如，URL 中包含的憑證)，getfattr 即為一例。這也適用於 user.xdg.referrer.url 中繼資料屬性中的 Referer 資訊。根據 Wget ChangeLog 中的 2016-07-22，user.xdg.origin.url 部分以 curl 中 tool_xattr.c 的 fwrite_xattr 行為為基礎。
    (CVE-2018-20483)

  - 在 libcurl 7.34.0 至 7.64.0 版中，處理 SMTP 回應結尾的程式碼容易發生堆積超出邊界讀取。如果傳遞至 `smtp_endofresp()` 的緩衝區不是以 NUL 結尾，且不含已剖析數字的字元結尾，而且 `len` 設為 5，則 `strtol()` 呼叫會讀取超出配置的緩衝區。讀取的內容將不會傳回給呼叫者。(CVE-2019-3823)

  - Libcurl 7.36.0 至 7.64.0 版容易發生堆積緩衝區超出邊界讀取。處理傳入 NTLM type-2 訊息的函式 (`lib/vauth/ntlm.c: ntlm_decode_type2_target`) 未正確驗證傳入的資料，而且容易受到整數溢位弱點影響。惡意或中斷的 NTLM 伺服器可利用該溢位，誘騙 libcurl 接受錯誤的長度 + 位移組合，進而導致緩衝區讀取超出邊界。(CVE-2018-16890)

  - libcurl 7.36.0 至 7.64.0 版容易受到堆疊型緩衝區溢位攻擊。建立傳出 NTLM type-3 標頭的函式 (`lib/vauth/ntlm.c: Curl_auth_create_ntlm_type3_message()`) 會根據先前收到的資料，產生要求 HTTP 標頭內容。為防止本機緩衝區溢位而存在的檢查實作錯誤 (使用無正負號的數學)，因此無法防止發生溢位。如果從惡意或中斷的 HTTP 伺服器提供的上一個 NTLMv2 標頭擷取非常大的「nt response」資料，此輸出資料可以增長到比本機緩衝區大。這種「大值」必須在 1000 位元組以上。複製到目標緩衝區的實際承載資料來自 NTLMv2 type-2 回應標頭。(CVE-2019-3822)

請注意，Nessus 並未測試這些問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

遠端主機受到 GLSA-201903-03 中所述的弱點影響 (cURL：多個弱點) 在 cURL 中發現多個弱點。如需詳細資訊，請檢閱以下提及的 CVE 識別碼。影響：遠端攻擊者可造成拒絕服務情況。因應措施：目前尚無已知的因應措施。

Multiple vulnerabilities were discovered in cURL, an URL transfer library.

  - CVE-2018-16890     Wenxiang Qian of Tencent Blade Team discovered that the     function handling incoming NTLM type-2 messages does not     validate incoming data correctly and is subject to an     integer overflow vulnerability, which could lead to an     out-of-bounds buffer read.

  - CVE-2019-3822     Wenxiang Qian of Tencent Blade Team discovered that the     function creating an outgoing NTLM type-3 header is     subject to an integer overflow vulnerability, which     could lead to an out-of-bounds write.

  - CVE-2019-3823     Brian Carpenter of Geeknik Labs discovered that the code     handling the end-of-response for SMTP is subject to an     out-of-bounds heap read.

New curl packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3882-1 advisory.

    Wenxiang Qian discovered that curl incorrectly handled certain NTLM authentication messages. A remote     attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. This     issue only applied to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10. (CVE-2018-16890)

    Wenxiang Qian discovered that curl incorrectly handled certain NTLMv2 authentication messages. A remote     attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10.
    (CVE-2019-3822)

    Brian Carpenter discovered that curl incorrectly handled certain SMTP responses. A remote attacker could     possibly use this issue to cause curl to crash, resulting in a denial of service. (CVE-2019-3823)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

curl security problems :

CVE-2018-16890: NTLM type-2 out-of-bounds buffer read

libcurl contains a heap buffer out-of-bounds read flaw.

The function handling incoming NTLM type-2 messages (lib/vauth/ntlm.c:ntlm_decode_type2_target) does not validate incoming data correctly and is subject to an integer overflow vulnerability.

Using that overflow, a malicious or broken NTLM server could trick libcurl to accept a bad length + offset combination that would lead to a buffer read out-of-bounds.

CVE-2019-3822: NTLMv2 type-3 header stack-based buffer overflow

libcurl contains a stack based buffer overflow vulnerability.

The function creating an outgoing NTLM type-3 header (lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()), generates the request HTTP header contents based on previously received data.
The check that exists to prevent the local buffer from getting overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from happening.

This output data can grow larger than the local buffer if very large 'nt response' data is extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server.

Such a 'large value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes from the NTLMv2 type-2 response header.

CVE-2019-3823: SMTP end-of-response out-of-bounds read

libcurl contains a heap out-of-bounds read in the code handling the end-of-response for SMTP.

If the buffer passed to smtp_endofresp() isn't NUL terminated and contains no character ending the parsed number, and len is set to 5, then the strtol() call reads beyond the allocated buffer. The read contents will not be returned to the caller.

This update for curl fixes the following issues :

Security issues fixed :

  - CVE-2019-3823: Fixed a heap out-of-bounds read in the     code handling the end-of-response for SMTP     (bsc#1123378).

  - CVE-2019-3822: Fixed a stack based buffer overflow in     the function creating an outgoing NTLM type-3 message     (bsc#1123377).

  - CVE-2018-16890: Fixed a heap buffer out-of-bounds read     in the function handling incoming NTLM type-2 messages     (bsc#1123371).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3701 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: NTLM type-2 heap out-of-bounds buffer read (CVE-2018-16890)

    * wget: Information exposure in set_file_metadata function in xattr.c (CVE-2018-20483)

    * curl: NTLMv2 type-3 header stack buffer overflow (CVE-2019-3822)

    * curl: SMTP end-of-response out-of-bounds read (CVE-2019-3823)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the cmake package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
180742	Oracle Linux 8：curl (ELSA-2019-3701)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/23	critical
122731	GLSA-201903-03：cURL：多個弱點	Nessus	Gentoo Local Security Checks	2019/3/11	2024/6/14	critical
121628	Debian DSA-4386-1 : curl - security update	Nessus	Debian Local Security Checks	2019/2/7	2024/6/24	critical
121632	Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2019-037-01)	Nessus	Slackware Local Security Checks	2019/2/7	2024/6/24	critical
121639	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : curl vulnerabilities (USN-3882-1)	Nessus	Ubuntu Local Security Checks	2019/2/7	2024/8/27	critical
122042	FreeBSD : curl -- multiple vulnerabilities (714b033a-2b09-11e9-8bc3-610fd6e6cd05)	Nessus	FreeBSD Local Security Checks	2019/2/8	2024/6/21	critical
122221	openSUSE Security Update : curl (openSUSE-2019-174)	Nessus	SuSE Local Security Checks	2019/2/15	2024/6/20	critical
130568	RHEL 8 : curl (RHSA-2019:3701)	Nessus	Red Hat Local Security Checks	2019/11/6	2025/3/16	critical
203839	Photon OS 3.0: Cmake PHSA-2023-3.0-0603	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical