It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker able to trick a user into connecting to a malicious server could use this flaw to set the user's cookie to a crafted domain, making other cookie-related issues easier to exploit. (CVE-2014-3613)

A flaw was found in the way the libcurl library performed the duplication of connection handles. If an application set the CURLOPT_COPYPOSTFIELDS option for a handle, using the handle's duplicate could cause the application to crash or disclose a portion of its memory. (CVE-2014-3707)

It was discovered that the libcurl library failed to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl to access a specially crafted URL via an HTTP proxy could use this flaw to inject additional headers to the request or construct additional requests. (CVE-2014-8150)

It was discovered that libcurl implemented aspects of the NTLM and Negotatiate authentication incorrectly. If an application uses libcurl and the affected mechanisms in a specifc way, certain requests to a previously NTLM-authenticated server could appears as sent by the wrong authenticated user. Additionally, the initial set of credentials for HTTP Negotiate- authenticated requests could be reused in subsequent requests, although a different set of credentials was specified. (CVE-2015-3143, CVE-2015-3148)

Bug fixes :

  - An out-of-protocol fallback to SSL version 3.0 (SSLv3.0)     was available with libcurl. Attackers could abuse the     fallback to force downgrade of the SSL version. The     fallback has been removed from libcurl. Users requiring     this functionality can explicitly enable SSLv3.0 through     the libcurl API.

  - A single upload transfer through the FILE protocol     opened the destination file twice. If the inotify kernel     subsystem monitored the file, two events were produced     unnecessarily. The file is now opened only once per     upload.

  - Utilities using libcurl for SCP/SFTP transfers could     terminate unexpectedly when the system was running in     FIPS mode.

  - Using the '--retry' option with the curl utility could     cause curl to terminate unexpectedly with a segmentation     fault. Now, adding '--retry' no longer causes curl to     crash.

  - The 'curl --trace-time' command did not use the correct     local time when printing timestamps. Now, 'curl
    --trace-time' works as expected.

  - The valgrind utility could report dynamically allocated     memory leaks on curl exit. Now, curl performs a global     shutdown of the NetScape Portable Runtime (NSPR) library     on exit, and valgrind no longer reports the memory     leaks.

  - Previously, libcurl returned an incorrect value of the     CURLINFO_HEADER_SIZE field when a proxy server appended     its own headers to the HTTP response. Now, the returned     value is valid.

Enhancements :

  - The '--tlsv1.0', '--tlsv1.1', and '--tlsv1.2' options     are available for specifying the minor version of the     TLS protocol to be negotiated by NSS. The '--tlsv1'     option now negotiates the highest version of the TLS     protocol supported by both the client and the server.

  - It is now possible to explicitly enable or disable the     ECC and the new AES cipher suites to be used for TLS.

Two vulnerabilities have been discovered in cURL, an URL transfer library. They can be use to leak cookie information :

  - CVE-2014-3613     By not detecting and rejecting domain names for partial     literal IP addresses properly when parsing received HTTP     cookies, libcurl can be fooled to both sending cookies     to wrong sites and into allowing arbitrary sites to set     cookies for others.

  - CVE-2014-3620     libcurl wrongly allows cookies to be set for Top Level     Domains (TLDs), thus making them apply broader than     cookies are allowed. This can allow arbitrary sites to     set cookies that then would get sent to a different and     unrelated site or domain.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2346-1 advisory.

    Tim Ruehsen discovered that curl incorrectly handled partial literal IP addresses. This could lead to the     disclosure of cookies to the wrong site, and malicious sites being able to set cookies for others.
    (CVE-2014-3613)

    Tim Ruehsen discovered that curl incorrectly allowed cookies to be set for Top Level Domains (TLDs). This     could allow a malicious site to set a cookie that gets sent to other sites. (CVE-2014-3620)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

libcurl wrongly allows cookies to be set for TLDs, thus making them much broader then they are supposed to be allowed to. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain.

By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others.

- Update to 7.39.0

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - require credentials to match for NTLM re-use     (CVE-2015-3143)

  - close Negotiate connections when done (CVE-2015-3148)

  - reject CRLFs in URLs passed to proxy (CVE-2014-8150)

  - use only full matches for hosts used as IP address in     cookies (CVE-2014-3613)

  - fix handling of CURLOPT_COPYPOSTFIELDS in     curl_easy_duphandle (CVE-2014-3707)

  - fix manpage typos found using aspell (#1011101)

  - fix comments about loading CA certs with NSS in man     pages (#1011083)

  - fix handling of DNS cache timeout while a transfer is in     progress (#835898)

  - eliminate unnecessary inotify events on upload via file     protocol (#883002)

  - use correct socket type in the examples (#997185)

  - do not crash if MD5 fingerprint is not provided by     libssh2 (#1008178)

  - fix SIGSEGV of curl --retry when network is down     (#1009455)

  - allow to use TLS 1.1 and TLS 1.2 (#1012136)

  - docs: update the links to cipher-suites supported by NSS     (#1104160)

  - allow to use ECC ciphers if NSS implements them     (#1058767)

  - make curl --trace-time print correct time (#1120196)

  - let tool call PR_Cleanup on exit if NSPR is used     (#1146528)

  - ignore CURLOPT_FORBID_REUSE during NTLM HTTP auth     (#1154747)

  - allow to enable/disable new AES cipher-suites (#1156422)

  - include response headers added by proxy in     CURLINFO_HEADER_SIZE (#1161163)

  - disable libcurl-level downgrade to SSLv3 (#1154059)

  - do not force connection close after failed HEAD request     (#1168137)

  - fix occasional SIGSEGV during SSL handshake (#1168668)

  - fix a connection failure when FTPS handle is reused     (#1154663)

  - fix re-use of wrong HTTP NTLM connection (CVE-2014-0015)

  - fix connection re-use when using different log-in     credentials (CVE-2014-0138)

  - fix authentication failure when server offers multiple     auth options (#799557)

  - refresh expired cookie in test172 from upstream     test-suite (#1069271)

  - fix a memory leak caused by write after close (#1078562)

  - nss: implement non-blocking SSL handshake (#1083742)

It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker able to trick a user into connecting to a malicious server could use this flaw to set the user's cookie to a crafted domain, making other cookie-related issues easier to exploit. (CVE-2014-3613)

A flaw was found in the way the libcurl library performed the duplication of connection handles. If an application set the CURLOPT_COPYPOSTFIELDS option for a handle, using the handle's duplicate could cause the application to crash or disclose a portion of its memory. (CVE-2014-3707)

It was discovered that the libcurl library failed to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl access a specially crafted URL via an HTTP proxy could use this flaw to inject additional headers to the request or construct additional requests. (CVE-2014-8150)

It was discovered that libcurl implemented aspects of the NTLM and Negotatiate authentication incorrectly. If an application uses libcurl and the affected mechanisms in a specifc way, certain requests to a previously NTLM-authenticated server could appears as sent by the wrong authenticated user. Additionally, the initial set of credentials for HTTP Negotiate- authenticated requests could be reused in subsequent requests, although a different set of credentials was specified. (CVE-2015-3143, CVE-2015-3148)

Bug fixes :

  - An out-of-protocol fallback to SSL 3.0 was available     with libcurl. Attackers could abuse the fallback to     force downgrade of the SSL version. The fallback has     been removed from libcurl. Users requiring this     functionality can explicitly enable SSL 3.0 through the     libcurl API.

  - TLS 1.1 and TLS 1.2 are no longer disabled by default in     libcurl. You can explicitly disable them through the     libcurl API.

  - FTP operations such as downloading files took a     significantly long time to complete. Now, the FTP     implementation in libcurl correctly sets blocking     direction and estimated timeout for connections,     resulting in faster FTP transfers.

Enhancements :

  - With the updated packages, it is possible to explicitly     enable or disable new Advanced Encryption Standard (AES)     cipher suites to be used for the TLS protocol.

  - The libcurl library did not implement a non-blocking SSL     handshake, which negatively affected performance of     applications based on the libcurl multi API. The     non-blocking SSL handshake has been implemented in     libcurl, and the libcurl multi API now immediately     returns the control back to the application whenever it     cannot read or write data from or to the underlying     network socket.

  - The libcurl library used an unnecessarily long blocking     delay for actions with no active file descriptors, even     for short operations. Some actions, such as resolving a     host name using /etc/hosts, took a long time to     complete. The blocking code in libcurl has been modified     so that the initial delay is short and gradually     increases until an event occurs.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2015-843:01 advisory.

    curl is a command line tool for transferring data with URL syntax, supporting     FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP,     SMTP, POP3 and RTSP.  curl supports SSL certificates, HTTP POST, HTTP PUT, FTP     uploading, HTTP form based upload, proxies, cookies, user password     authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer     resume, proxy tunneling and a busload of other useful tricks.
    Security issues fixed with this release:
    CVE-2014-3613     cURL and libcurl before 7.38.0 does not properly handle IP addresses     in cookie domain names, which allows remote attackers to set cookies     for or send arbitrary cookies to certain sites, as demonstrated by a     site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
    CVE-2014-3707     The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0,     when running with the CURLOPT_COPYPOSTFIELDS option, does not properly     copy HTTP POST data for an easy handle, which triggers an     out-of-bounds read that allows remote web servers to read sensitive     memory information.
    CVE-2014-8150     CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0,     when using an HTTP proxy, allows remote attackers to inject arbitrary     HTTP headers and conduct HTTP response splitting attacks via CRLF     sequences in a URL.
    CVE-2015-3143     cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM     connections, which allows remote attackers to connect as other users     via an unauthenticated request, a similar issue to CVE-2014-0015.
    CVE-2015-3148     cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use     authenticated Negotiate connections, which allows remote attackers to     connect as other users via a request.
    Fixed bugs:
    * An out-of-protocol fallback to SSL 3.0 was available with libcurl. Attackers could abuse the fallback to     force downgrade of the SSL version. The fallback has been removed from libcurl. Users requiring this     functionality can explicitly enable SSL 3.0 through the libcurl API.
    * TLS 1.1 and TLS 1.2 are no longer disabled by default in libcurl. You can explicitly disable them     through the libcurl API.
    * FTP operations such as downloading files took a significantly long time to complete. Now, the FTP     implementation in libcurl correctly sets blocking direction and estimated timeout for connections,     resulting in faster FTP transfers.
    Enhancements:
    * With the updated packages, it is possible to explicitly enable or disable new Advanced Encryption     Standard (AES) cipher suites to be used for the TLS protocol.
    * The libcurl library did not implement a non-blocking SSL handshake, which negatively affected     performance of applications based on the libcurl multi API. The non-blocking SSL handshake has been     implemented in libcurl, and the libcurl multi API now immediately returns the control back to the     application whenever it cannot read or write data from or to the underlying network socket.
    * The libcurl library used an unnecessarily long blocking delay for actions with no active file     descriptors, even for short operations. Some actions, such as resolving a host name using /etc/hosts, took     a long time to complete. The blocking code in libcurl has been modified so that the initial delay is short     and gradually increases until an event occurs.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- use only full matches for hosts used as IP address in     cookies (CVE-2014-3613)

    - reject incoming cookies set for top level domains       (CVE-2014-3620)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Solaris system is missing necessary patches to address security updates.

CVE-2014-3613

By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2159 advisory.

    - require credentials to match for NTLM re-use (CVE-2015-3143)
    - close Negotiate connections when done (CVE-2015-3148)
    - reject CRLFs in URLs passed to proxy (CVE-2014-8150)
    - use only full matches for hosts used as IP address in cookies (CVE-2014-3613)
    - fix handling of CURLOPT_COPYPOSTFIELDS in curl_easy_duphandle (CVE-2014-3707)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
85191	Scientific Linux Security Update : curl on SL6.x i386/x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	2015/8/4	2021/1/14	medium
77611	Debian DSA-3022-1 : curl - security update	Nessus	Debian Local Security Checks	2014/9/11	2021/1/11	medium
77701	Ubuntu 14.04 LTS : curl vulnerabilities (USN-2346-1)	Nessus	Ubuntu Local Security Checks	2014/9/16	2024/8/27	critical
78350	Amazon Linux AMI : curl (ALAS-2014-407)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	medium
80324	Fedora 20 : mingw-curl-7.39.0-1.fc20 (2014-17596)	Nessus	Fedora Local Security Checks	2015/1/2	2021/1/11	medium
85148	OracleVM 3.3 : curl (OVMSA-2015-0107)	Nessus	OracleVM Local Security Checks	2015/7/31	2021/1/4	medium
87554	Scientific Linux Security Update : curl on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	2015/12/22	2021/1/14	medium
289422	MiracleLinux 7 : curl-7.29.0-25.0.1.el7.AXS7 (AXSA:2015-843:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
77677	Fedora 20 : curl-7.32.0-13.fc20 (2014-10741)	Nessus	Fedora Local Security Checks	2014/9/15	2021/1/11	medium
77792	Fedora 21 : curl-7.37.0-7.fc21 (2014-10679)	Nessus	Fedora Local Security Checks	2014/9/23	2021/1/11	medium
80325	Fedora 21 : mingw-curl-7.39.0-1.fc21 (2014-17601)	Nessus	Fedora Local Security Checks	2015/1/2	2021/1/11	medium
80663	Oracle Solaris Third-Party Patch Update : libcurl (cve_2014_3613_cookie_leak)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
82209	Debian DLA-64-1 : curl security update	Nessus	Debian Local Security Checks	2015/3/26	2021/1/11	medium
87028	Oracle Linux 7 : curl (ELSA-2015-2159)	Nessus	Oracle Linux Local Security Checks	2015/11/24	2024/10/22	critical

检测

插件搜索

medium

medium

critical

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

critical