According to the versions of the curl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - curl before version 7.61.1 is vulnerable to a buffer     overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the     length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap.
    The length value is then subsequently used to iterate     over the password and generate output into the     allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer     overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very     small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer     end up in a heap buffer overflow. (This bug is almost     identical to CVE-2017-8816.)(CVE-2018-14618)

  - It was found that libcurl did not safely parse FTP URLs     when using the CURLOPT_FTP_FILEMETHOD method. An     attacker, able to provide a specially crafted FTP URL     to an application using libcurl, could write a NULL     byte at an arbitrary location, resulting in a crash, or     an unspecified behavior.(CVE-2018-1000120)

  - A NULL pointer dereference flaw was found in the way     libcurl checks values returned by the openldap     ldap_get_attribute_ber() function. A malicious LDAP     server could use this flaw to crash a libcurl client     application via a specially crafted LDAP     reply.(CVE-2018-1000121)

  - A buffer over-read exists in curl 7.20.0 to and     including curl 7.58.0 in the RTSP+RTP handling code     that allows an attacker to cause a denial of service or     information leakage.(CVE-2018-1000122)

  - curl version curl 7.20.0 to and including curl 7.59.0     contains a CWE-126: Buffer Over-read vulnerability in     denial of service that can result in curl can be     tricked into reading data beyond the end of a heap     based buffer used to store downloaded RTSP content..
    (CVE-2018-1000301)

  - A buffer overrun flaw was found in the IMAP handler of     libcurl. By tricking an unsuspecting user into     connecting to a malicious IMAP server, an attacker     could exploit this flaw to potentially cause     information disclosure or crash the     application.(CVE-2017-1000257)

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external entities.
    (CVE-2018-1000007)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2019-3739:01 advisory.

    * httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for     CGI applications (CVE-2018-1283)
    * httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)
    * httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)
    * httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)
    * httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values     (CVE-2017-15710)
    * httpd:  bypass with a trailing newline in the file name (CVE-2017-15715)
    * httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)
    * httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)
    * curl: Multiple security issues were fixed in httpd24-curl (CVE-2016-5419, CVE-2016-5420, CVE-2016-5421,     CVE-2016-7141, CVE-2016-7167, CVE-2016-8615, CVE-2016-8616, CVE-2016-8617, CVE-2016-8618, CVE-2016-8619,     CVE-2016-8620, CVE-2016-8621, CVE-2016-8622, CVE-2016-8623, CVE-2016-8624, CVE-2016-8625, CVE-2016-9586,     CVE-2017-1000100, CVE-2017-1000101, CVE-2017-1000254, CVE-2017-1000257, CVE-2017-7407, CVE-2017-8816,     CVE-2017-8817, CVE-2018-1000007, CVE-2018-1000120, CVE-2018-1000121, CVE-2018-1000122, CVE-2018-1000301,     CVE-2018-14618)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has curl packages installed that are affected by a vulnerability:

  - curl before version 7.61.1 is vulnerable to a buffer     overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the length     of the password by two (SUM) to figure out how large     temporary storage area to allocate from the heap. The     length value is then subsequently used to iterate over     the password and generate output into the allocated     storage buffer. On systems with a 32 bit size_t, the     math to calculate SUM triggers an integer overflow when     the password length exceeds 2GB (2^31 bytes). This     integer overflow usually causes a very small buffer to     actually get allocated instead of the intended very huge     one, making the use of that buffer end up in a heap     buffer overflow. (This bug is almost identical to     CVE-2017-8816.) (CVE-2018-14618)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- fix NTLM password overflow via integer overflow     (CVE-2018-14618)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues :

This security issue was fixed :

CVE-2018-14618: Prevent integer overflow in the NTLM authentication code (bsc#1106019)

The update package also includes non-security fixes. See advisory for details.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - curl before version 7.61.1 is vulnerable to a buffer     overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the     length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap.
    The length value is then subsequently used to iterate     over the password and generate output into the     allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer     overflow when the password length exceeds 2GB (2^31     bytes). This integer overflow usually causes a very     small buffer to actually get allocated instead of the     intended very huge one, making the use of that buffer     end up in a heap buffer overflow. (This bug is almost     identical to CVE-2017-8816.)i1/4^CVE-2018-14618i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - curl before version 7.61.1 is vulnerable to a buffer     overrun in the NTLM authentication code. The internal     function Curl_ntlm_core_mk_nt_hash multiplies the     length of the password by two (SUM) to figure out how     large temporary storage area to allocate from the heap.
    The length value is then subsequently used to iterate     over the password and generate output into the     allocated storage buffer. On systems with a 32 bit     size_t, the math to calculate SUM triggers an integer     overflow when the password length exceeds 2GB (2^31     bytes).(CVE-2018-14618)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201903-03 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-1880 advisory.

    - CVE-2016-8615 cookie injection for other servers (https://curl.haxx.se/docs/CVE-2016-8615.html)
    - CVE-2016-8616 case insensitive password comparison (https://curl.haxx.se/docs/CVE-2016-8616.html)
    - CVE-2016-8617 OOB write via unchecked multiplication (https://curl.haxx.se/docs/CVE-2016-8617.html)
    - CVE-2016-8618 double-free in curl_maprintf (https://curl.haxx.se/docs/CVE-2016-8618.html)
    - CVE-2016-8619 double-free in krb5 code (https://curl.haxx.se/docs/CVE-2016-8619.html)
    - CVE-2016-8621 curl_getdate read out of bounds (https://curl.haxx.se/docs/CVE-2016-8621.html)
    - CVE-2016-8622 URL unescape heap overflow via integer truncation     (https://curl.haxx.se/docs/CVE-2016-8622.html)
    - CVE-2016-8623 Use-after-free via shared cookies (https://curl.haxx.se/docs/CVE-2016-8623.html)
    - CVE-2016-8624 invalid URL parsing with # (https://curl.haxx.se/docs/CVE-2016-8624.html)
    - fix NTLM password overflow via integer overflow (CVE-2018-14618)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es) :

  - curl: NTLM password overflow via integer overflow     (CVE-2018-14618) For more details about the security     issue(s), including the impact, a CVSS score,     acknowledgments, and other related information, refer to     the CVE page(s) listed in the References section.

    Bug Fix(es) :

  - baseurl with file:// hangs and then timeout in yum repo     (BZ#1709474)

  - curl crashes on http links with rate-limit (BZ#1711914)

An update of the curl package has been released.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
124993	EulerOS Virtualization for ARM 64 3.0.1.0 : curl (EulerOS-SA-2019-1540)	Nessus	Huawei Local Security Checks	2019/5/14	2024/5/22	critical
289086	MiracleLinux 7 : httpd24-nghttp2-1.7.1-7.el7, httpd24-curl-7.61.1-1.el7, httpd24-httpd-2.4.34-7.el7 (AXSA:2019-3739:01)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	critical
128701	NewStart CGSL CORE 5.05 / MAIN 5.05 : curl Vulnerability (NS-SA-2019-0171)	Nessus	NewStart CGSL Local Security Checks	2019/9/11	2021/1/14	critical
117622	Fedora 27 : curl (2018-ba443bcb6d)	Nessus	Fedora Local Security Checks	2018/9/21	2024/8/6	critical
120099	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2018:2714-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/10	critical
120239	Fedora 28 : curl (2018-111044d435)	Nessus	Fedora Local Security Checks	2019/1/3	2024/7/9	critical
123705	EulerOS Virtualization 2.5.4 : curl (EulerOS-SA-2019-1237)	Nessus	Huawei Local Security Checks	2019/4/4	2024/6/6	critical
122374	EulerOS 2.0 SP2 : curl (EulerOS-SA-2019-1047)	Nessus	Huawei Local Security Checks	2019/2/22	2024/6/18	critical
122731	GLSA-201903-03 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2019/3/11	2024/6/14	critical
127604	Oracle Linux 7 : curl (ELSA-2019-1880)	Nessus	Oracle Linux Local Security Checks	2019/8/12	2024/10/23	critical
127724	Scientific Linux Security Update : curl on SL7.x x86_64 (20190729)	Nessus	Scientific Linux Local Security Checks	2019/8/12	2024/5/6	critical
203121	Photon OS 2.0: Curl PHSA-2019-2.0-0128	Nessus	PhotonOS Local Security Checks	2024/7/23	2024/7/23	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical