The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3598-1 advisory.

    Phan Thanh discovered that curl incorrectly handled certain FTP paths. An attacker could use this to cause     a denial of service or possibly execute arbitrary code. (CVE-2018-1000120)

    Dario Weisser discovered that curl incorrectly handled certain LDAP URLs. An attacker could possibly use     this issue to cause a denial of service. (CVE-2018-1000121)

    Max Dymond discovered that curl incorrectly handled certain RTSP data. An attacker could possibly use this     to cause a denial of service or even to get access to sensitive data. (CVE-2018-1000122)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- fix FTP path trickery leads to NIL byte out of bounds     write (CVE-2018-1000120)

  - fix LDAP NULL pointer dereference (CVE-2018-1000121)

  - fix RTSP RTP buffer over-read (CVE-2018-1000122)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage(CVE-2018-1000122)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues: curl was updated to version 7.37.0 (fate#325339 bsc#1084137) This update syncs the curl version to the one in SUSE Linux Enterprise 12 and is full binary compatible to the previous version. This update is done to allow other third-party software like 'R' to be able to be used on the SUSE Linux Enterprise 11 codebase. Following security issues were fixed :

  - CVE-2018-1000120: A buffer overflow exists in the FTP     URL handling that allowed an attacker to cause a denial     of service or possible code execution (bsc#1084521).

  - CVE-2018-1000121: A NULL pointer dereference exists in     the LDAP code that allowed an attacker to cause a denial     of service (bsc#1084524).

  - CVE-2018-1000122: A buffer over-read exists in the     RTSP+RTP handling code that allowed an attacker to cause     a denial of service or information leakage     (bsc#1084532). The package also requires a libopenssl     that implements the DEFAULT_SUSE cipher list     (bsc#1081056, bsc#1083463,bsc#1086825)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Oracle Secure Global Desktop installed on the remote host is 5.3 / 5.4 and is missing a security patch from the July 2018 Critical Patch Update (CPU). It is, therefore, affected by multiple vulnerabilities:

 - curl version curl 7.54.1 to and including curl 7.59.0 contains a  Heap-based Buffer Overflow vulnerability in FTP connection closing  down functionality which can lead to DoS and RCE conditions. This  vulnerability appears to have been fixed in curl < 7.54.1 and  curl >= 7.60.0. (CVE-2018-1000300)

 - Security constraints defined by annotations of Servlets in Apache  Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and  7.0.0 to 7.0.84 were only applied once a Servlet had been loaded.  It was possible - depending on the order Servlets were loaded - for  some security constraints not to be applied. This could have exposed  resources to unauthorized users. (CVE-2018-1305)

 - ASN.1 types with a recursive definition could exceed the stack  given malicious input with excessive recursion. This could result  in a Denial Of Service attack. Fixed in OpenSSL 1.1.0h (Affected  1.1.0-1.1.0g). Fixed in OpenSSL 1.0.2o (Affected 1.0.2b-1.0.2n).
 (CVE-2018-0739)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3157 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    The nss-pem package provides the PEM file reader for Network Security Services (NSS) implemented as a     PKCS#11 module.

    Security Fix(es):

    * curl: HTTP authentication leak in redirects (CVE-2018-1000007)

    * curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)

    * curl: RTSP RTP buffer over-read (CVE-2018-1000122)

    * curl: Out-of-bounds heap read when missing RTSP headers allows information leak of denial of service     (CVE-2018-1000301)

    * curl: LDAP NULL pointer dereference (CVE-2018-1000121)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank the Curl project for reporting these issues. Upstream acknowledges Craig de     Stigter as the original reporter of CVE-2018-1000007; Duy Phan Thanh as the original reporter of     CVE-2018-1000120; Max Dymond as the original reporter of CVE-2018-1000122; the OSS-fuzz project as the     original reporter of CVE-2018-1000301; and Dario Weisser as the original reporter of CVE-2018-1000121.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Oracle HTTP Server installed on the remote host is affected by vulnerabilities as noted in the October 2018 CPU advisory:

  - A vulnerability exists in the Oracle HTTP Server component     of Oracle Fusion Middleware (subcomponent: Web Listener     (curl)). The affected version is 12.2.1.3. This is a     difficult to exploit vulnerability that allows an     unauthenticated attacker with network access via HTTP to     compromise Oracle HTTP Server. A successful attacks     requires human interaction from a person other than the     attacker. Successful attacks of this vulnerability can     result in takeover of Oracle HTTP Server. (CVE-2018-1000300)     
  - A denial of service (DoS) vulnerability exists in curl due     to Buffer Over-read. Affected versions are from curl version     7.20.0 to curl 7.59.0. The vulnerable component can be     tricked into reading data beyond the end of the heap.
    An unauthenticated attacked with network access can exploit     this issue to cause the application to stop responding.
    (CVE-2018-1000301)

  - A buffer over-read vulnerability exists in curl that could lead to     information leakage. Affected versions are from  7.20.0 to     curl 7.58.0. A vulnerability in the RTSP+RTP handling code     could allows an attacker to cause a denial of service or     information leakage. An unauthenticated attacked with     network access can exploit this vulnerability to cause     a denial of service (DoS) or to leak information     from the vulnerable application.
    (CVE-2018-1000122)

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3745:01 advisory.

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)
    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)
    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)
    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)
    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)
    * httpd:  bypass with a trailing newline in the file name (CVE-2017-15715)
    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)
    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)
    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
108403	Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerabilities (USN-3598-1)	Nessus	Ubuntu Local Security Checks	2018/3/16	2024/8/27	critical
108500	Fedora 26 : curl (2018-66c96e0024)	Nessus	Fedora Local Security Checks	2018/3/21	2024/12/19	critical
109507	EulerOS 2.0 SP1 : curl (EulerOS-SA-2018-1109)	Nessus	Huawei Local Security Checks	2018/5/2	2024/10/15	critical
109890	SUSE SLES11 Security Update : curl (SUSE-SU-2018:1323-1)	Nessus	SuSE Local Security Checks	2018/5/17	2024/10/4	critical
111333	Oracle Secure Global Desktop Multiple Vulnerabilities (July 2018 CPU)	Nessus	Misc.	2018/7/25	2021/10/25	critical
118532	RHEL 7 : curl and nss-pem (RHSA-2018:3157)	Nessus	Red Hat Local Security Checks	2018/10/31	2025/4/15	critical
124090	Oracle Fusion Middleware Oracle HTTP Server Multiple Vulnerabilities (October 2018 CPU)	Nessus	Web Servers	2019/4/16	2024/6/19	critical
289425	MiracleLinux 4 : httpd24-nghttp2-1.7.1-7.AXS4, httpd24-curl-7.61.1-1.AXS4, httpd24-httpd-2.4.34-7.AXS4 (AXSA:2019-3745:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical