The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0544 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: HTTP authentication leak in redirects (CVE-2018-1000007)

    * curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)

    * curl: RTSP RTP buffer over-read (CVE-2018-1000122)

    * curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service     (CVE-2018-1000301)

    * curl: LDAP NULL pointer dereference (CVE-2018-1000121)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3739:01 advisory.

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)
    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)
    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)
    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)
    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)
    * httpd:  bypass with a trailing newline in the file name (CVE-2017-15715)
    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)
    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)
    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - curl before version 7.61.1 is vulnerable to a buffer     overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the     length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap.
    The length value is then subsequently used to iterate     over the password and generate output into the     allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer     overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very     small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer     end up in a heap buffer overflow. (This bug is almost     identical to CVE-2017-8816.)(CVE-2018-14618)

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage.(CVE-2018-1000122)

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a CWE-126: Buffer Over-read vulnerability in     denial of service that can result in curl can be     tricked into reading data beyond the end of a heap     based buffer used to store downloaded RTSP content..
    (CVE-2018-1000301)

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker     could exploit this flaw to potentially cause     information disclosure or crash the     application.(CVE-2017-1000257)

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external entities.
    (CVE-2018-1000007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- fix FTP shutdown response buffer overflow     (CVE-2018-1000300)

  - fix RTSP bad headers buffer over-read (CVE-2018-1000301)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New curl packages are available for Slackware 14.0, 14.1, 14.2, and
-current to fix security issues.

This update for curl to version 7.60.0 fixes the following issues :

These security issues were fixed :

  - CVE-2018-1000300: Prevent heap-based buffer overflow     when closing down an FTP connection with very long     server command replies (bsc#1092094).

  - CVE-2018-1000301: Prevent buffer over-read that could     have cause reading data beyond the end of a heap based     buffer used to store downloaded RTSP content     (bsc#1092098).

These non-security issues were fixed :

  - Add CURLOPT_HAPROXYPROTOCOL, support for the HAProxy     PROXY protocol

  - Add --haproxy-protocol for the command line tool

  - Add CURLOPT_DNS_SHUFFLE_ADDRESSES, shuffle returned IP     addresses 

  - FTP: fix typo in recursive callback detection for     seeking

  - test1208: marked flaky

  - HTTP: make header-less responses still count correct     body size

  - user-agent.d:: mention --proxy-header as well

- http2: fixes typo

  - cleanup: misc typos in strings and comments

  - rate-limit: use three second window to better handle     high speeds

  - examples/hiperfifo.c: improved

  - pause: when changing pause state, update socket state

  - curl_version_info.3: fix ssl_version description

  - add_handle/easy_perform: clear errorbuffer on start if     set

  - cmake: add support for brotli

  - parsedate: support UT timezone

  - vauth/ntlm.h: fix the #ifdef header guard

  - lib/curl_path.h: added #ifdef header guard

  - vauth/cleartext: fix integer overflow check

  - CURLINFO_COOKIELIST.3: made the example not leak memory

  - cookie.d: mention that '-' as filename means stdin

  - CURLINFO_SSL_VERIFYRESULT.3: fixed the example

- http2: read pending frames   (including GOAWAY) in connection-check

  - timeval: remove compilation warning by casting

  - cmake: avoid warn-as-error during config checks

  - travis-ci: enable -Werror for CMake builds

  - openldap: fix for NULL return from     ldap_get_attribute_ber()

  - threaded resolver: track resolver time and set suitable     timeout values

  - cmake: Add advapi32 as explicit link library for win32

  - docs: fix CURLINFO_*_T examples use of     CURL_FORMAT_CURL_OFF_T

  - test1148: set a fixed locale for the test

  - cookies: when reading from a file, only remove_expired     once

  - cookie: store cookies per top-level-domain-specific hash     table

  - openssl: RESTORED verify locations when verifypeer==0

  - file: restore old behavior for file:////foo/bar URLs

  - FTP: allow PASV on IPv6 connections when a proxy is     being used

  - build-openssl.bat: allow custom paths for VS and perl

  - winbuild: make the clean target work without build-type

  - build-openssl.bat: Refer to VS2017 as VC14.1 instead of     VC15

  - curl: retry on FTP 4xx, ignore other protocols

  - configure: detect (and use) sa_family_t

  - examples/sftpuploadresume: Fix Windows large file seek

  - build: cleanup to fix clang warnings/errors

  - winbuild: updated the documentation

  - lib: silence null-dereference warnings

  - travis: bump to clang 6 and gcc 7

  - travis: build libpsl and make builds use it

  - proxy: show getenv proxy use in verbose output

  - duphandle: make sure CURLOPT_RESOLVE is duplicated

  - all: Refactor malloc+memset to use calloc

  - checksrc: Fix typo

  - system.h: Add sparcv8plus to oracle/sunpro 32-bit     detection

  - vauth: Fix typo

  - ssh: show libSSH2 error code when closing fails

  - test1148: tolerate progress updates better

  - urldata: make service names unconditional

  - configure: keep LD_LIBRARY_PATH changes local

  - ntlm_sspi: fix authentication using Credential Manager

  - schannel: add client certificate authentication

  - winbuild: Support custom devel paths for each dependency

  - schannel: add support for CURLOPT_CAINFO

- http2: handle on_begin_headers() called more than once

  - openssl: support OpenSSL 1.1.1 verbose-mode trace     messages

  - openssl: fix subjectAltName check on non-ASCII platforms

- http2: avoid strstr() on data not zero terminated

- http2: clear the 'drain counter' when a stream is closed

- http2: handle GOAWAY properly

  - tool_help: clarify --max-time unit of time is seconds

  - curl.1: clarify that options and URLs can be mixed

- http2: convert an assert to run-time check

  - curl_global_sslset: always provide available backends

  - ftplistparser: keep state between invokes

  - Curl_memchr: zero length input can't match

  - examples/sftpuploadresume: typecast fseek argument to     long

  - examples/http2-upload: expand buffer to avoid silly     warning

  - ctype: restore character classification for non-ASCII     platforms

  - mime: avoid NULL pointer dereference risk

  - cookies: ensure that we have cookies before writing jar

  - os400.c: fix checksrc warnings

  - configure: provide --with-wolfssl as an alias for
    --with-cyassl

  - cyassl: adapt to libraries without TLS 1.0 support     built-in

- http2: get rid of another strstr

  - checksrc: force indentation of lines after an else

  - cookies: remove unused macro

  - CURLINFO_PROTOCOL.3: mention the existing defined names

  - tests: provide 'manual' as a feature to optionally     require

  - travis: enable libssh2 on both macos and Linux

  - CURLOPT_URL.3: added ENCODING section

  - wolfssl: Fix non-blocking connect

  - vtls: don't define MD5_DIGEST_LENGTH for wolfssl

  - docs: remove extraneous commas in man pages

  - URL: fix ASCII dependency in strcpy_url and strlen_url

  - ssh-libssh.c: fix left shift compiler warning

  - configure: only check for CA bundle for file-using SSL     backends

  - travis: add an mbedtls build

- http: don't set the 'rewind' flag when not uploading anything

  - configure: put CURLDEBUG and DEBUGBUILD in     lib/curl_config.h

  - transfer: don't unset writesockfd on setup of     multiplexed conns

  - vtls: use unified 'supports' bitfield member in backends

  - URLs: fix one more http url

  - travis: add a build using WolfSSL

  - openssl: change FILE ops to BIO ops

  - travis: add build using NSS

  - smb: reject negative file sizes

  - cookies: accept parameter names as cookie name

- http2: getsock fix for uploads

  - all over: fixed format specifiers

- http2: use the correct function pointer typedef

This update for curl fixes the following issues :

  - CVE-2018-1000301: Fixed a buffer over-read caused by bad     RTSP headers (bsc#1092098)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update for curl and nss-pem is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

The nss-pem package provides the PEM file reader for Network Security Services (NSS) implemented as a PKCS#11 module.

Security Fix(es) :

* curl: HTTP authentication leak in redirects (CVE-2018-1000007)

* curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)

* curl: RTSP RTP buffer over-read (CVE-2018-1000122)

* curl: Out-of-bounds heap read when missing RTSP headers allows information leak of denial of service (CVE-2018-1000301)

* curl: LDAP NULL pointer dereference (CVE-2018-1000121)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank the Curl project for reporting these issues. Upstream acknowledges Craig de Stigter as the original reporter of CVE-2018-1000007; Duy Phan Thanh as the original reporter of CVE-2018-1000120; Max Dymond as the original reporter of CVE-2018-1000122; the OSS-fuzz project as the original reporter of CVE-2018-1000301; and Dario Weisser as the original reporter of CVE-2018-1000121.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

The nss-pem package provides the PEM file reader for Network Security Services (NSS) implemented as a PKCS#11 module. This update contains fixes related to CURL security updates, specifically updating an object ID when reusing a certificate

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a CWE-126: Buffer Over-read vulnerability in     denial of service that can result in curl can be     tricked into reading data beyond the end of a heap     based buffer used to store downloaded RTSP     content..(CVE-2018-1000301)

  - It was found that the libcurl library did not check the     client certificate when choosing the TLS connection to     reuse. An attacker could potentially use this flaw to     hijack the authentication of the connection by     leveraging a previously created connection with a     different client certificate.(CVE-2016-5420)

  - It was discovered that libcurl could incorrectly reuse     NTLM-authenticated connections for subsequent     unauthenticated requests to the same host. If an     application using libcurl established an     NTLM-authenticated connection to a server, and sent     subsequent unauthenticated requests to the same server,     the unauthenticated requests could be sent over the     NTLM-authenticated connection, appearing as if they     were sent by the NTLM authenticated     user.(CVE-2015-3143)

  - libcurl may read outside of a heap allocated buffer     when doing FTP. When libcurl connects to an FTP server     and successfully logs in (anonymous or not), it asks     the server for the current directory with the `PWD`     command. The server then responds with a 257 response     containing the path, inside double quotes. The returned     path name is then kept by libcurl for subsequent uses.
    Due to a flaw in the string parser for this directory     name, a directory name passed like this but without a     closing double quote would lead to libcurl not adding a     trailing NUL byte to the buffer holding the name. When     libcurl would then later access the string, it could     read beyond the allocated heap buffer and crash or     wrongly access data beyond the buffer, thinking it was     part of the path. A malicious server could abuse this     fact and effectively prevent libcurl-based clients to     work with it - the PWD command is always issued on new     FTP connections and the mistake has a high chance of     causing a segfault. The simple fact that this has issue     remained undiscovered for this long could suggest that     malformed PWD responses are rare in benign servers. We     are not aware of any exploit of this flaw. This bug was     introduced in commit     415d2e7cb7(https://github.com/curl/curl/commit/415d2e7c     b7), March 2005. In libcurl version 7.56.0, the parser     always zero terminates the string but also rejects it     if not terminated properly with a final double     quote.(CVE-2017-1000254)

  - It was discovered that libcurl could incorrectly reuse     Negotiate authenticated HTTP connections for subsequent     requests. If an application using libcurl established a     Negotiate authenticated HTTP connection to a server and     sent subsequent requests with different credentials,     the connection could be re-used with the initial set of     credentials instead of using the new     ones.(CVE-2015-3148)

  - Heap-based buffer overflow in the curl_easy_unescape     function in lib/escape.c in cURL and libcurl 7.7     through 7.30.0 allows remote attackers to cause a     denial of service (application crash) or possibly     execute arbitrary code via a crafted string ending in a     ''%'' (percent) character.(CVE-2013-2174)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8616)

  - ** RESERVED ** This candidate has been reserved by an     organization or individual that will use it when     announcing a new security problem. When the candidate     has been publicized, the details for this candidate     will be provided.(CVE-2016-8619)

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external     entities.(CVE-2018-1000007)

  - A flaw was found in the way the libcurl library     performed the duplication of connection handles. If an     application set the CURLOPT_COPYPOSTFIELDS option for a     handle, using the handle's duplicate could cause the     application to crash or disclose a portion of its     memory.(CVE-2014-3707)

  - Multiple integer overflow flaws leading to heap-based     buffer overflows were found in the way curl handled     escaping and unescaping of data. An attacker could     potentially use these flaws to crash an application     using libcurl by sending a specially crafted input to     the affected libcurl functions.(CVE-2016-7167)

  - When doing a TFTP transfer and curl/libcurl is given a     URL that contains a very long file name (longer than     about 515 bytes), the file name is truncated to fit     within the buffer boundaries, but the buffer size is     still wrongly updated to use the untruncated length.
    This too large value is then used in the sendto() call,     making curl attempt to send more data than what is     actually put into the buffer. The endto() function will     then read beyond the end of the heap based buffer. A     malicious HTTP(S) server could redirect a vulnerable     libcurl-using client to a crafted TFTP URL (if the     client hasn't restricted which protocols it allows     redirects to) and trick it to send private memory     contents to a remote server over UDP. Limit curl's     redirect protocols with --proto-redir and libcurl's     with CURLOPT_REDIR_PROTOCOLS.(CVE-2017-1000100)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
133787	RHEL 7 : curl (RHSA-2020:0544)	Nessus	Red Hat Local Security Checks	2020/2/19	2024/11/7	critical
289086	MiracleLinux 7 : httpd24-nghttp2-1.7.1-7.el7, httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7 (AXSA:2019-3739:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
124993	EulerOS Virtualization for ARM 64 3.0.1.0 : curl (EulerOS-SA-2019-1540)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical
110061	Fedora 27 : curl (2018-9dc7338487)	Nessus	Fedora Local Security Checks	2018/5/24	2024/10/3	critical
109870	Slackware 14.0 / 14.1 / 14.2 / current : curl (SSA:2018-136-01)	Nessus	Slackware Local Security Checks	2018/5/17	2024/10/7	critical
123190	openSUSE Security Update : curl (openSUSE-2019-435)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/12	critical
110260	SUSE SLES11 Security Update : curl (SUSE-SU-2018:1478-1)	Nessus	SuSE Local Security Checks	2018/5/31	2024/9/26	critical
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	critical
118996	CentOS 7 : curl / nss-pem (CESA-2018:3157)	Nessus	CentOS Local Security Checks	2018/11/16	2021/4/8	critical
121048	Amazon Linux 2 : nss-pem (ALAS-2019-1139)	Nessus	Amazon Linux Local Security Checks	2019/1/10	2024/6/27	critical
125003	EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1550)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical