The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3765-1 advisory.

    It was discovered that curl incorrectly handled certain inputs. An attacker could possibly use this to     execute arbitrary code.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - curl before version 7.61.1 is vulnerable to a buffer     overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the     length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap.
    The length value is then subsequently used to iterate     over the password and generate output into the     allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer     overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very     small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer     end up in a heap buffer overflow. (This bug is almost     identical to CVE-2017-8816.)(CVE-2018-14618)

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage.(CVE-2018-1000122)

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a CWE-126: Buffer Over-read vulnerability in     denial of service that can result in curl can be     tricked into reading data beyond the end of a heap     based buffer used to store downloaded RTSP content..
    (CVE-2018-1000301)

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker     could exploit this flaw to potentially cause     information disclosure or crash the     application.(CVE-2017-1000257)

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external entities.
    (CVE-2018-1000007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues :

CVE-2018-14618: Prevent integer overflow in the NTLM authentication code (bsc#1106019).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- fix NTLM password overflow via integer overflow     (CVE-2018-14618)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the curl package has been released.

This update for curl fixes the following issues :

This security issue was fixed :

  - CVE-2018-14618: Prevent integer overflow in the NTLM     authentication code (bsc#1106019)

This non-security issue was fixed :

  - Use OPENSSL_config instead of CONF_modules_load_file()     to avoid crashes due to openssl engines conflicts     (bsc#1086367)

This update was imported from the SUSE:SLE-15:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - curl before version 7.61.1 is vulnerable to a buffer overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap. The length value is then subsequently used to     iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is     almost identical to CVE-2017-8816.) (CVE-2018-14618)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1880 advisory.

    The curl packages provide the libcurl library and the curl utility for downloading files from servers     using various protocols, including HTTP, FTP, and LDAP.

    Security Fix(es):

    * curl: NTLM password overflow via integer overflow (CVE-2018-14618)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * baseurl with file:// hangs and then timeout in yum repo (BZ#1709474)

    * curl crashes on http links with rate-limit (BZ#1711914)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has curl packages installed that are affected by a vulnerability:

  - curl before version 7.61.1 is vulnerable to a buffer     overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length     of the password by two (SUM) to figure out how large     temporary storage area to allocate from the heap. The     length value is then subsequently used to iterate over     the password and generate output into the allocated     storage buffer. On systems with a 32 bit size_t, the     math to calculate SUM triggers an integer overflow when     the password length exceeds 2GB (2^31 bytes). This     integer overflow usually causes a very small buffer to     actually get allocated instead of the intended very huge     one, making the use of that buffer end up in a heap     buffer overflow. (This bug is almost identical to     CVE-2017-8816.) (CVE-2018-14618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for curl fixes the following issues :

This security issue was fixed :

  - CVE-2018-14618: Prevent integer overflow in the NTLM     authentication code (bsc#1106019)

This non-security issue was fixed :

  - Fixed erroneous debug message when paired with OpenSSL     (bsc#1089533)

This update was imported from the SUSE:SLE-12:Update update project.

curl is vulnerable to a buffer overrun in the NTLM authentication code. The internal function Curl_ntlm_core_mk_nt_hash multiplies the length of the password by two (SUM) to figure out how large temporary storage area to allocate from the heap. The length value is then subsequently used to iterate over the password and generate output into the allocated storage buffer. On systems with a 32 bit size_t, the math to calculate SUM triggers an integer overflow when the password length exceeds 2GB (2^31 bytes). This integer overflow usually causes a very small buffer to actually get allocated instead of the intended very huge one, making the use of that buffer end up in a heap buffer overflow. (This bug is almost identical to CVE-2017-8816 .)(CVE-2018-14618)

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
154827	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : curl vulnerability (USN-3765-1)	Nessus	Ubuntu Local Security Checks	2021/11/2	2024/8/27	critical
124993	EulerOS Virtualization for ARM 64 3.0.1.0 : curl (EulerOS-SA-2019-1540)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical
117529	SUSE SLES11 Security Update : curl (SUSE-SU-2018:2717-1)	Nessus	SuSE Local Security Checks	2018/9/17	2024/8/7	critical
120567	Fedora 29 : curl (2018-7f83032de6)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/2	critical
122898	Photon OS 1.0: Curl PHSA-2019-1.0-0205	Nessus	PhotonOS Local Security Checks	2019/3/18	2024/6/13	critical
123302	openSUSE Security Update : curl (openSUSE-2019-694)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/11	critical
221972	Linux Distros Unpatched Vulnerability : CVE-2018-14618	Nessus	Misc.	2025/3/4	2026/7/24	critical
127619	RHEL 7 : curl (RHSA-2019:1880)	Nessus	Red Hat Local Security Checks	2019/8/12	2024/11/7	critical
129904	NewStart CGSL CORE 5.04 / MAIN 5.04 : curl Vulnerability (NS-SA-2019-0182)	Nessus	NewStart CGSL Local Security Checks	2019/10/15	2021/1/14	critical
117520	openSUSE Security Update : curl (openSUSE-2018-1008)	Nessus	SuSE Local Security Checks	2018/9/17	2024/8/7	critical
117521	openSUSE Security Update : curl (openSUSE-2018-1010)	Nessus	SuSE Local Security Checks	2018/9/17	2024/8/7	critical
119789	Amazon Linux 2 : curl (ALAS-2018-1135)	Nessus	Amazon Linux Local Security Checks	2018/12/20	2024/7/15	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical