An update of the cmake package has been released.

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8623)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8622)

  - It was found that the libcurl library did not prevent     TLS session resumption when the client certificate had     changed. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate.(CVE-2016-5419)

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker     could exploit this flaw to potentially cause     information disclosure or crash the     application.(CVE-2017-1000257)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8624)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8621)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage(CVE-2018-1000122)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-9586)

  - The FTP wildcard function in curl and libcurl before     7.57.0 allows remote attackers to cause a denial of     service (out-of-bounds read and application crash) or     possibly have unspecified other impact via a string     that ends with an '' character.(CVE-2017-8817)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8618)

  - It was found that the libcurl library using the NSS     (Network Security Services) library as TLS/SSL backend     incorrectly re-used client certificates for subsequent     TLS connections in certain cases. An attacker could     potentially use this flaw to hijack the authentication     of the connection by leveraging a previously created     connection with a different client     certificate.(CVE-2016-7141)

  - cURL and libcurl 7.10.6 through 7.34.0, when more than     one authentication method is enabled, re-uses NTLM     connections, which might allow context-dependent     attackers to authenticate as other users via a     request.(CVE-2014-0015)

  - The tailMatch function in cookie.c in cURL and libcurl     before 7.30.0 does not properly match the path domain     when sending cookies, which allows remote attackers to     steal cookies via a matching suffix in the domain of a     URL.(CVE-2013-1944)

  - It was discovered that the libcurl library failed to     properly handle URLs with embedded end-of-line     characters. An attacker able to make an application     using libcurl access a specially crafted URL via an     HTTP proxy could use this flaw to inject additional     headers to the request or construct additional     requests.(CVE-2014-8150)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8615)

  - The default configuration in cURL and libcurl 7.10.6     before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4)     POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9)     LDAP, and (10) LDAPS connections, which might allow     context-dependent attackers to connect as other users     via a request, a similar issue to     CVE-2014-0015.(CVE-2014-0138)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8617)

  - It was found that the libcurl library did not correctly     handle partial literal IP addresses when parsing     received HTTP cookies. An attacker able to trick a user     into connecting to a malicious server could use this     flaw to set the user's cookie to a crafted domain,     making other cookie-related issues easier to     exploit.(CVE-2014-3613)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

libcurl was updated to fix security issues :

CVE-2014-3613: Cookies for hosts specified by numeric IP could be assigned or used for other numeric IP hosts if portions of the numerics were the same.

CVE-2014-3620: libcurl allowed cookies to be set for toplevel domains, making them to broad.

- use only full matches for hosts used as IP address in     cookies (CVE-2014-3613)

    - reject incoming cookies set for top level domains       (CVE-2014-3620)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated curl packages fix security vulnerabilities :

Paras Sethia discovered that libcurl would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same server, sending requests for one user over the connection authenticated as a different user (CVE-2014-0015).

libcurl can in some circumstances re-use the wrong connection when asked to do transfers using other protocols than HTTP and FTP, causing a transfer that was initiated by an application to wrongfully re-use an existing connection to the same server that was authenticated using different credentials (CVE-2014-0138).

libcurl incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or just fool users into believing that it is a legitimate site (CVE-2014-0139).

In cURL before 7.38.0, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. For this problem to trigger, the client application must use the numerical IP address in the URL to access the site (CVE-2014-3613).

In cURL before 7.38.0, libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain (CVE-2014-3620).

Symeon Paraschoudis discovered that the curl_easy_duphandle() function in cURL has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending, while performing a HTTP POST operation. This bug requires CURLOPT_COPYPOSTFIELDS and curl_easy_duphandle() to be used in that order, and then the duplicate handle must be used to perform the HTTP POST. The curl command line tool is not affected by this problem as it does not use this sequence (CVE-2014-3707).

When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL (CVE-2014-8150).

It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker able to trick a user into connecting to a malicious server could use this flaw to set the user's cookie to a crafted domain, making other cookie-related issues easier to exploit. (CVE-2014-3613)

A flaw was found in the way the libcurl library performed the duplication of connection handles. If an application set the CURLOPT_COPYPOSTFIELDS option for a handle, using the handle's duplicate could cause the application to crash or disclose a portion of its memory. (CVE-2014-3707)

It was discovered that the libcurl library failed to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl to access a specially crafted URL via an HTTP proxy could use this flaw to inject additional headers to the request or construct additional requests. (CVE-2014-8150)

It was discovered that libcurl implemented aspects of the NTLM and Negotatiate authentication incorrectly. If an application uses libcurl and the affected mechanisms in a specifc way, certain requests to a previously NTLM-authenticated server could appears as sent by the wrong authenticated user. Additionally, the initial set of credentials for HTTP Negotiate- authenticated requests could be reused in subsequent requests, although a different set of credentials was specified. (CVE-2015-3143, CVE-2015-3148)

Bug fixes :

  - An out-of-protocol fallback to SSL version 3.0 (SSLv3.0)     was available with libcurl. Attackers could abuse the     fallback to force downgrade of the SSL version. The     fallback has been removed from libcurl. Users requiring     this functionality can explicitly enable SSLv3.0 through     the libcurl API.

  - A single upload transfer through the FILE protocol     opened the destination file twice. If the inotify kernel     subsystem monitored the file, two events were produced     unnecessarily. The file is now opened only once per     upload.

  - Utilities using libcurl for SCP/SFTP transfers could     terminate unexpectedly when the system was running in     FIPS mode.

  - Using the '--retry' option with the curl utility could     cause curl to terminate unexpectedly with a segmentation     fault. Now, adding '--retry' no longer causes curl to     crash.

  - The 'curl --trace-time' command did not use the correct     local time when printing timestamps. Now, 'curl
    --trace-time' works as expected.

  - The valgrind utility could report dynamically allocated     memory leaks on curl exit. Now, curl performs a global     shutdown of the NetScape Portable Runtime (NSPR) library     on exit, and valgrind no longer reports the memory     leaks.

  - Previously, libcurl returned an incorrect value of the     CURLINFO_HEADER_SIZE field when a proxy server appended     its own headers to the HTTP response. Now, the returned     value is valid.

Enhancements :

  - The '--tlsv1.0', '--tlsv1.1', and '--tlsv1.2' options     are available for specifying the minor version of the     TLS protocol to be negotiated by NSS. The '--tlsv1'     option now negotiates the highest version of the TLS     protocol supported by both the client and the server.

  - It is now possible to explicitly enable or disable the     ECC and the new AES cipher suites to be used for TLS.

Two vulnerabilities have been discovered in cURL, an URL transfer library. They can be use to leak cookie information :

  - CVE-2014-3613     By not detecting and rejecting domain names for partial     literal IP addresses properly when parsing received HTTP     cookies, libcurl can be fooled to both sending cookies     to wrong sites and into allowing arbitrary sites to set     cookies for others.

  - CVE-2014-3620     libcurl wrongly allows cookies to be set for Top Level     Domains (TLDs), thus making them apply broader than     cookies are allowed. This can allow arbitrary sites to     set cookies that then would get sent to a different and     unrelated site or domain.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2346-1 advisory.

    Tim Ruehsen discovered that curl incorrectly handled partial literal IP addresses. This could lead to the     disclosure of cookies to the wrong site, and malicious sites being able to set cookies for others.
    (CVE-2014-3613)

    Tim Ruehsen discovered that curl incorrectly allowed cookies to be set for Top Level Domains (TLDs). This     could allow a malicious site to set a cookie that gets sent to other sites. (CVE-2014-3620)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

libcurl wrongly allows cookies to be set for TLDs, thus making them much broader then they are supposed to be allowed to. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain.

By not detecting and rejecting domain names for partial literal IP addresses properly when parsing received HTTP cookies, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others.

- Update to 7.39.0

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote OracleVM system is missing necessary patches to address critical security updates :

  - require credentials to match for NTLM re-use     (CVE-2015-3143)

  - close Negotiate connections when done (CVE-2015-3148)

  - reject CRLFs in URLs passed to proxy (CVE-2014-8150)

  - use only full matches for hosts used as IP address in     cookies (CVE-2014-3613)

  - fix handling of CURLOPT_COPYPOSTFIELDS in     curl_easy_duphandle (CVE-2014-3707)

  - fix manpage typos found using aspell (#1011101)

  - fix comments about loading CA certs with NSS in man     pages (#1011083)

  - fix handling of DNS cache timeout while a transfer is in     progress (#835898)

  - eliminate unnecessary inotify events on upload via file     protocol (#883002)

  - use correct socket type in the examples (#997185)

  - do not crash if MD5 fingerprint is not provided by     libssh2 (#1008178)

  - fix SIGSEGV of curl --retry when network is down     (#1009455)

  - allow to use TLS 1.1 and TLS 1.2 (#1012136)

  - docs: update the links to cipher-suites supported by NSS     (#1104160)

  - allow to use ECC ciphers if NSS implements them     (#1058767)

  - make curl --trace-time print correct time (#1120196)

  - let tool call PR_Cleanup on exit if NSPR is used     (#1146528)

  - ignore CURLOPT_FORBID_REUSE during NTLM HTTP auth     (#1154747)

  - allow to enable/disable new AES cipher-suites (#1156422)

  - include response headers added by proxy in     CURLINFO_HEADER_SIZE (#1161163)

  - disable libcurl-level downgrade to SSLv3 (#1154059)

  - do not force connection close after failed HEAD request     (#1168137)

  - fix occasional SIGSEGV during SSL handshake (#1168668)

  - fix a connection failure when FTPS handle is reused     (#1154663)

  - fix re-use of wrong HTTP NTLM connection (CVE-2014-0015)

  - fix connection re-use when using different log-in     credentials (CVE-2014-0138)

  - fix authentication failure when server offers multiple     auth options (#799557)

  - refresh expired cookie in test172 from upstream     test-suite (#1069271)

  - fix a memory leak caused by write after close (#1078562)

  - nss: implement non-blocking SSL handshake (#1083742)

It was found that the libcurl library did not correctly handle partial literal IP addresses when parsing received HTTP cookies. An attacker able to trick a user into connecting to a malicious server could use this flaw to set the user's cookie to a crafted domain, making other cookie-related issues easier to exploit. (CVE-2014-3613)

A flaw was found in the way the libcurl library performed the duplication of connection handles. If an application set the CURLOPT_COPYPOSTFIELDS option for a handle, using the handle's duplicate could cause the application to crash or disclose a portion of its memory. (CVE-2014-3707)

It was discovered that the libcurl library failed to properly handle URLs with embedded end-of-line characters. An attacker able to make an application using libcurl access a specially crafted URL via an HTTP proxy could use this flaw to inject additional headers to the request or construct additional requests. (CVE-2014-8150)

It was discovered that libcurl implemented aspects of the NTLM and Negotatiate authentication incorrectly. If an application uses libcurl and the affected mechanisms in a specifc way, certain requests to a previously NTLM-authenticated server could appears as sent by the wrong authenticated user. Additionally, the initial set of credentials for HTTP Negotiate- authenticated requests could be reused in subsequent requests, although a different set of credentials was specified. (CVE-2015-3143, CVE-2015-3148)

Bug fixes :

  - An out-of-protocol fallback to SSL 3.0 was available     with libcurl. Attackers could abuse the fallback to     force downgrade of the SSL version. The fallback has     been removed from libcurl. Users requiring this     functionality can explicitly enable SSL 3.0 through the     libcurl API.

  - TLS 1.1 and TLS 1.2 are no longer disabled by default in     libcurl. You can explicitly disable them through the     libcurl API.

  - FTP operations such as downloading files took a     significantly long time to complete. Now, the FTP     implementation in libcurl correctly sets blocking     direction and estimated timeout for connections,     resulting in faster FTP transfers.

Enhancements :

  - With the updated packages, it is possible to explicitly     enable or disable new Advanced Encryption Standard (AES)     cipher suites to be used for the TLS protocol.

  - The libcurl library did not implement a non-blocking SSL     handshake, which negatively affected performance of     applications based on the libcurl multi API. The     non-blocking SSL handshake has been implemented in     libcurl, and the libcurl multi API now immediately     returns the control back to the application whenever it     cannot read or write data from or to the underlying     network socket.

  - The libcurl library used an unnecessarily long blocking     delay for actions with no active file descriptors, even     for short operations. Some actions, such as resolving a     host name using /etc/hosts, took a long time to     complete. The blocking code in libcurl has been modified     so that the initial delay is short and gradually     increases until an event occurs.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
203839	Photon OS 3.0: Cmake PHSA-2023-3.0-0603	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2015/8/17	2024/5/28	high
125002	EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1549)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical
77734	openSUSE Security Update : curl (openSUSE-SU-2014:1139-1)	Nessus	SuSE Local Security Checks	2014/9/18	2021/1/19	medium
78093	Fedora 19 : curl-7.29.0-23.fc19 (2014-10714)	Nessus	Fedora Local Security Checks	2014/10/9	2021/1/11	medium
82351	Mandriva Linux Security Advisory : curl (MDVSA-2015:098)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	medium
85191	Scientific Linux Security Update : curl on SL6.x i386/x86_64 (20150722)	Nessus	Scientific Linux Local Security Checks	2015/8/4	2021/1/14	medium
204588	Photon OS 4.0: Cmake PHSA-2023-4.0-0420	Nessus	PhotonOS Local Security Checks	2024/7/24	2024/7/24	critical
77611	Debian DSA-3022-1 : curl - security update	Nessus	Debian Local Security Checks	2014/9/11	2021/1/11	medium
77701	Ubuntu 14.04 LTS : curl vulnerabilities (USN-2346-1)	Nessus	Ubuntu Local Security Checks	2014/9/16	2024/8/27	critical
78350	Amazon Linux AMI : curl (ALAS-2014-407)	Nessus	Amazon Linux Local Security Checks	2014/10/12	2018/4/18	medium
80324	Fedora 20 : mingw-curl-7.39.0-1.fc20 (2014-17596)	Nessus	Fedora Local Security Checks	2015/1/2	2021/1/11	medium
85148	OracleVM 3.3 : curl (OVMSA-2015-0107)	Nessus	OracleVM Local Security Checks	2015/7/31	2021/1/4	medium
87554	Scientific Linux Security Update : curl on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	2015/12/22	2021/1/14	medium

检测

插件搜索

critical

high

critical

medium

medium

medium

medium

critical

medium

critical

medium

medium

medium

medium