The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3882-1 advisory.

    Wenxiang Qian discovered that curl incorrectly handled certain NTLM authentication messages. A remote     attacker could possibly use this issue to cause curl to crash, resulting in a denial of service. This     issue only applied to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10. (CVE-2018-16890)

    Wenxiang Qian discovered that curl incorrectly handled certain NTLMv2 authentication messages. A remote     attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly     execute arbitrary code. This issue only applied to Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 18.10.
    (CVE-2019-3822)

    Brian Carpenter discovered that curl incorrectly handled certain SMTP responses. A remote attacker could     possibly use this issue to cause curl to crash, resulting in a denial of service. (CVE-2019-3823)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201903-03 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

An update of the cmake package has been released.

New curl packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

The version of MySQL running on the remote host is 5.7.x prior to 5.7.27. It is, therefore, affected by multiple vulnerabilities, including three of the top vulnerabilities below, as noted in the July 2019 Critical Patch Update advisory:

  - A stack-based buffer overflow vulnerability in the     'Server: Packaging (cURL)' subcomponent could allow an     unauthenticated attacker to gain complete control of an     affected instance of MySQL Server. (CVE-2019-3822)

  - A vulnerability in the 'Server: Parser' subcomponent.
    This is an easily exploitable vulnerability that allows     a low privileged attacker with network access via     multiple protocols to compromise the server. Successful     attacks involving this vulnerability can result in the     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS). (CVE-2019-2805)

  - A vulnerability in the 'Server: XML' subcomponent. This     is an easily exploitable vulnerability that allows a     low privileged attacker with network access via multiple     protocols to compromise a server.Successful attacks     involving this vulnerability can result in the     unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS).
    (CVE-2019-2740)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3701 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: NTLM type-2 heap out-of-bounds buffer read (CVE-2018-16890)

    * wget: Information exposure in set_file_metadata function in xattr.c (CVE-2018-20483)

    * curl: NTLMv2 type-3 header stack buffer overflow (CVE-2019-3822)

    * curl: SMTP end-of-response out-of-bounds read (CVE-2019-3823)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.1 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0078 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-3822:
    libcurl versions from 7.36.0 to before 7.64.0 are vulnerable to a stack-based buffer overflow. The     function creating an outgoing NTLM type-3 header     (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`), generates the request HTTP header contents     based on previously received data. The check that exists to prevent the local buffer from getting     overflowed is implemented wrongly (using unsigned math) and as such it does not prevent the overflow from     happening. This output data can grow larger than the local buffer if very large 'nt response' data is     extracted from a previous NTLMv2 header provided by the malicious or broken HTTP server. Such a 'large     value' needs to be around 1000 bytes or more. The actual payload data copied to the target buffer comes     from the NTLMv2 type-2 response header.

    CVE-2019-3823:
    libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code     handling the end-of-response for SMTP. If the buffer passed to `smtp_endofresp()` isn't NUL terminated and     contains no character ending the parsed number, and `len` is set to 5, then the `strtol()` call reads     beyond the allocated buffer. The read contents will not be returned to the caller.

    CVE-2019-5436:
    A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl     versions 7.19.4 through 7.64.1.

    CVE-2019-5481:
    Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.

    CVE-2019-5482:
    Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.

    CVE-2020-8177:
    curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources     that can lead too overwriting a local file when the -J flag is used.

    CVE-2020-8231:
    Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending     data.

    CVE-2020-8284:
    A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to     a given IP address and port, and this way potentially make curl extract information about services that     are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

    CVE-2020-8285:
    curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue     in FTP wildcard match parsing.

    CVE-2020-8286:
    curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to     insufficient verification of the OCSP response.

    CVE-2021-22946:
    A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an     IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL`     or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly     crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations
    **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear     text over the network.

    CVE-2021-22947:
    When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to     upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches.
    curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using     and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw,     it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS     traffic from the legitimate server and trick curl into sending data back to the user thinking the     attacker's injected data comes from the TLS-protected server.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2019:3701 advisory.

  - curl: NTLM type-2 heap out-of-bounds buffer read (CVE-2018-16890)

  - wget: Information exposure in set_file_metadata function in xattr.c (CVE-2018-20483)

  - curl: NTLMv2 type-3 header stack buffer overflow (CVE-2019-3822)

  - curl: SMTP end-of-response out-of-bounds read (CVE-2019-3823)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were discovered in cURL, an URL transfer library.

  - CVE-2018-16890     Wenxiang Qian of Tencent Blade Team discovered that the     function handling incoming NTLM type-2 messages does not     validate incoming data correctly and is subject to an     integer overflow vulnerability, which could lead to an     out-of-bounds buffer read.

  - CVE-2019-3822     Wenxiang Qian of Tencent Blade Team discovered that the     function creating an outgoing NTLM type-3 header is     subject to an integer overflow vulnerability, which     could lead to an out-of-bounds write.

  - CVE-2019-3823     Brian Carpenter of Geeknik Labs discovered that the code     handling the end-of-response for SMTP is subject to an     out-of-bounds heap read.

This update for curl fixes the following issues :

Security issues fixed :

  - CVE-2019-3823: Fixed a heap out-of-bounds read in the     code handling the end-of-response for SMTP     (bsc#1123378).

  - CVE-2019-3822: Fixed a stack based buffer overflow in     the function creating an outgoing NTLM type-3 message     (bsc#1123377).

  - CVE-2018-16890: Fixed a heap buffer out-of-bounds read     in the function handling incoming NTLM type-2 messages     (bsc#1123371).

This update was imported from the SUSE:SLE-15:Update update project.

This update for curl fixes the following issues :

Security issues fixed :

CVE-2019-3823: Fixed a heap out-of-bounds read in the code handling the end-of-response for SMTP (bsc#1123378).

CVE-2019-3822: Fixed a stack-based buffer overflow in the function creating an outgoing NTLM type-3 message (bsc#1123377).

CVE-2018-16890: Fixed a heap buffer out-of-bounds read in the function handling incoming NTLM type-2 messages (bsc#1123371).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
121639	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : curl vulnerabilities (USN-3882-1)	Nessus	Ubuntu Local Security Checks	2019/2/7	2024/8/27	critical
122731	GLSA-201903-03 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2019/3/11	2024/6/14	critical
203839	Photon OS 3.0: Cmake PHSA-2023-3.0-0603	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical
121632	Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2019-037-01)	Nessus	Slackware Local Security Checks	2019/2/7	2024/6/24	critical
126783	MySQL 5.7.x < 5.7.27 Multiple Vulnerabilities (Jul 2019 CPU)	Nessus	Databases	2019/7/18	2024/5/9	critical
130568	RHEL 8 : curl (RHSA-2019:3701)	Nessus	Red Hat Local Security Checks	2019/11/6	2025/3/16	critical
236591	Alibaba Cloud Linux 3 : 0078: curl (ALINUX3-SA-2021:0078)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/15	critical
122910	Photon OS 2.0: Curl PHSA-2019-2.0-0131	Nessus	PhotonOS Local Security Checks	2019/3/18	2024/7/22	high
202895	Photon OS 3.0: Curl PHSA-2019-3.0-0002	Nessus	PhotonOS Local Security Checks	2024/7/22	2024/7/24	critical
145603	CentOS 8 : curl (CESA-2019:3701)	Nessus	CentOS Local Security Checks	2021/1/29	2024/1/25	critical
121628	Debian DSA-4386-1 : curl - security update	Nessus	Debian Local Security Checks	2019/2/7	2024/6/24	critical
122221	openSUSE Security Update : curl (openSUSE-2019-174)	Nessus	SuSE Local Security Checks	2019/2/15	2024/6/20	critical
121635	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2019:0249-1)	Nessus	SuSE Local Security Checks	2019/2/7	2024/6/24	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

high

critical

critical

critical

critical

critical