According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage(CVE-2018-1000122)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage(CVE-2018-1000122)

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a Buffer Over-read vulnerability in denial of     service that can result in curl can be tricked into     reading data beyond the end of a heap based buffer used     to store downloaded rtsp content.(CVE-2018-1000301)

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a Buffer Over-read vulnerability in denial of     service that can result in curl can be tricked into     reading data beyond the end of a heap based buffer used     to store downloaded rtsp content.(CVE-2016-9586)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3669:01 advisory.

    * curl: HTTP authentication leak in redirects (CVE-2018-1000007)
      * curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)
      * curl: RTSP RTP buffer over-read (CVE-2018-1000122)
      * curl: Out-of-bounds heap read when missing RTSP headers allows information leak of denial of service     (CVE-2018-1000301)
      * curl: LDAP NULL pointer dereference (CVE-2018-1000121)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0594 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: HTTP authentication leak in redirects (CVE-2018-1000007)

    * curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)

    * curl: RTSP RTP buffer over-read (CVE-2018-1000122)

    * curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service     (CVE-2018-1000301)

    * curl: LDAP NULL pointer dereference (CVE-2018-1000121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple vulnerabilities were found in cURL, an URL transfer library :

CVE-2018-1000120

Duy Phan Thanh reported that curl could be fooled into writing a zero byte out of bounds when curl was told to work on an FTP URL, with the setting to only issue a single CWD command. The issue could be triggered if the directory part of the URL contained a '%00' sequence.

CVE-2018-1000121

Dario Weisser reported that curl might dereference a near-NULL address when getting an LDAP URL. A malicious server that sends a particularly crafted response could made crash applications that allowed LDAP URL relying on libcurl.

CVE-2018-1000122

OSS-fuzz and Max Dymond found that curl can be tricked into copying data beyond the end of its heap based buffer when asked to transfer an RTSP URL. curl could calculate a wrong data length to copy from the read buffer. This could lead to information leakage or a denial of service.

For Debian 7 'Wheezy', these problems have been fixed in version 7.26.0-1+wheezy25.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- fix FTP path trickery leads to NIL byte out of bounds     write (CVE-2018-1000120)

  - fix LDAP NULL pointer dereference (CVE-2018-1000121)

  - fix RTSP RTP buffer over-read (CVE-2018-1000122)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

FTP path trickery leads to NIL byte out of bounds write :

It was found that libcurl did not safely parse FTP URLs when using the CURLOPT_FTP_FILEMETHOD method. An attacker, able to provide a specially crafted FTP URL to an application using libcurl, could write a NULL byte at an arbitrary location, resulting in a crash, or an unspecified behavior. (CVE-2018-1000120)

LDAP NULL pointer dereference :

A NULL pointer dereference flaw was found in the way libcurl checks values returned by the openldap ldap_get_attribute_ber() function. A malicious LDAP server could use this flaw to crash a libcurl client application via a specially crafted LDAP reply. (CVE-2018-1000121)

RTSP RTP buffer over-read :

A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage. (CVE-2018-1000122)

According to the versions of the curl package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage(CVE-2018-1000122)

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a Buffer Over-read vulnerability in denial of     service that can result in curl can be tricked into     reading data beyond the end of a heap based buffer used     to store downloaded rtsp content.(CVE-2018-1000301)

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a Buffer Over-read vulnerability in denial of     service that can result in curl can be tricked into     reading data beyond the end of a heap based buffer used     to store downloaded rtsp content.(CVE-2016-9586)

  - libcurl may read outside of a heap allocated buffer     when doing FTP. When libcurl connects to an FTP server     and successfully logs in (anonymous or not), it asks     the server for the current directory with the `PWD`     command. The server then responds with a 257 response     containing the path, inside double quotes. The returned     path name is then kept by libcurl for subsequent uses.
    Due to a flaw in the string parser for this directory     name, a directory name passed like this but without a     closing double quote would lead to libcurl not adding a     trailing NUL byte to the buffer holding the name. When     libcurl would then later access the string, it could     read beyond the allocated heap buffer and crash or     wrongly access data beyond the buffer, thinking it was     part of the path. A malicious server could abuse this     fact and effectively prevent libcurl-based clients to     work with it - the PWD command is always issued on new     FTP connections and the mistake has a high chance of     causing a segfault. The simple fact that this has issue     remained undiscovered for this long could suggest that     malformed PWD responses are rare in benign servers. We     are not aware of any exploit of this flaw. This bug was     introduced in commit     [415d2e7cb7](https://github.com/curl/curl/commit/415d2e     7cb7), March 2005. In libcurl version 7.56.0, the     parser always zero terminates the string but also     rejects it if not terminated properly with a final     double quote.i1/4^CVE-2017-1000254i1/4%0

  - The FTP wildcard function in curl and libcurl before     7.57.0 allows remote attackers to cause a denial of     service (out-of-bounds read and application crash) or     possibly have unspecified other impact via a string     that ends with an '[' character.The FTP wildcard     function in curl and libcurl before 7.57.0 allows     remote attackers to cause a denial of service     (out-of-bounds read and application crash) or possibly     have unspecified other impact via a string that ends     with an '[' character.i1/4^CVE-2017-8817i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-3157 advisory.

    - fix RTSP bad headers buffer over-read (CVE-2018-1000301)
    - fix FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)
    - fix LDAP NULL pointer dereference (CVE-2018-1000121)
    - fix RTSP RTP buffer over-read (CVE-2018-1000122)
    - http: prevent custom Authorization headers in redirects (CVE-2018-1000007)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- http2: mark the connection for close on GOAWAY

  - new upstream release (7.59.0)

  - FTP path trickery leads to NIL byte out of bounds write     (CVE-2018-1000120)

  - LDAP NULL pointer dereference (CVE-2018-1000121)

  - RTSP RTP buffer over-read (CVE-2018-1000122)

  - ftp: fix typo in recursive callback detection for     seeking

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8623)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8622)

  - It was found that the libcurl library did not prevent     TLS session resumption when the client certificate had     changed. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate.(CVE-2016-5419)

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker     could exploit this flaw to potentially cause     information disclosure or crash the     application.(CVE-2017-1000257)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8624)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8621)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage(CVE-2018-1000122)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-9586)

  - The FTP wildcard function in curl and libcurl before     7.57.0 allows remote attackers to cause a denial of     service (out-of-bounds read and application crash) or     possibly have unspecified other impact via a string     that ends with an '' character.(CVE-2017-8817)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8618)

  - It was found that the libcurl library using the NSS     (Network Security Services) library as TLS/SSL backend     incorrectly re-used client certificates for subsequent     TLS connections in certain cases. An attacker could     potentially use this flaw to hijack the authentication     of the connection by leveraging a previously created     connection with a different client     certificate.(CVE-2016-7141)

  - cURL and libcurl 7.10.6 through 7.34.0, when more than     one authentication method is enabled, re-uses NTLM     connections, which might allow context-dependent     attackers to authenticate as other users via a     request.(CVE-2014-0015)

  - The tailMatch function in cookie.c in cURL and libcurl     before 7.30.0 does not properly match the path domain     when sending cookies, which allows remote attackers to     steal cookies via a matching suffix in the domain of a     URL.(CVE-2013-1944)

  - It was discovered that the libcurl library failed to     properly handle URLs with embedded end-of-line     characters. An attacker able to make an application     using libcurl access a specially crafted URL via an     HTTP proxy could use this flaw to inject additional     headers to the request or construct additional     requests.(CVE-2014-8150)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8615)

  - The default configuration in cURL and libcurl 7.10.6     before 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4)     POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9)     LDAP, and (10) LDAPS connections, which might allow     context-dependent attackers to connect as other users     via a request, a similar issue to     CVE-2014-0015.(CVE-2014-0138)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8617)

  - It was found that the libcurl library did not correctly     handle partial literal IP addresses when parsing     received HTTP cookies. An attacker able to trick a user     into connecting to a malicious server could use this     flaw to set the user's cookie to a crafted domain,     making other cookie-related issues easier to     exploit.(CVE-2014-3613)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has curl packages installed that are affected by multiple vulnerabilities:

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a CWE-126: Buffer Over-read vulnerability in     denial of service that can result in curl can be tricked     into reading data beyond the end of a heap based buffer     used to store downloaded RTSP content.. This     vulnerability appears to have been fixed in curl <     7.20.0 and curl >= 7.60.0. (CVE-2018-1000301)

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL to     an application using libcurl, could write a NULL byte at     an arbitrary location, resulting in a crash or an     unspecified behavior. (CVE-2018-1000120)

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP reply.
    (CVE-2018-1000121)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code that     allows an attacker to cause a denial of service or     information leakage (CVE-2018-1000122)

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external entities.
    (CVE-2018-1000007)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
109508	EulerOS 2.0 SP2 : curl (EulerOS-SA-2018-1110)	Nessus	Huawei Local Security Checks	2018/5/2	2024/10/15	critical
110867	EulerOS 2.0 SP3 : curl (EulerOS-SA-2018-1203)	Nessus	Huawei Local Security Checks	2018/7/3	2024/9/9	critical
289211	MiracleLinux 7 : nss-pem-1.0.3-5.el7, curl-7.29.0-51.el7 (AXSA:2019-3669:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
134066	RHEL 7 : curl (RHSA-2020:0594)	Nessus	Red Hat Local Security Checks	2020/2/26	2024/11/7	critical
108416	Debian DLA-1309-1 : curl security update	Nessus	Debian Local Security Checks	2018/3/19	2025/1/29	critical
108502	Fedora 27 : curl (2018-8877b4ccac)	Nessus	Fedora Local Security Checks	2018/3/21	2024/12/19	critical
109184	Amazon Linux AMI : curl (ALAS-2018-995)	Nessus	Amazon Linux Local Security Checks	2018/4/20	2024/10/30	critical
118418	EulerOS Virtualization 2.5.0 : curl (EulerOS-SA-2018-1330)	Nessus	Huawei Local Security Checks	2018/10/26	2022/2/3	critical
118775	Oracle Linux 7 : curl / and / nss-pem (ELSA-2018-3157)	Nessus	Oracle Linux Local Security Checks	2018/11/7	2024/10/22	critical
120747	Fedora 28 : curl (2018-bc65ab5014)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/1	critical
125002	EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1549)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical
127212	NewStart CGSL CORE 5.04 / MAIN 5.04 : curl Multiple Vulnerabilities (NS-SA-2019-0039)	Nessus	NewStart CGSL Local Security Checks	2019/8/12	2021/1/14	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical