Vulnerabilities > CVE-2010-0734 - Permissions, Privileges, and Access Controls vulnerability in Curl Libcurl

047910
CVSS 6.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
curl
CWE-264
nessus

Summary

content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Accessing, Modifying or Executing Executable Files
    An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
  • Leverage Executable Code in Non-Executable Files
    An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
  • Blue Boxing
    This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
  • Restful Privilege Elevation
    Rest uses standard HTTP (Get, Put, Delete) style permissions methods, but these are not necessarily correlated generally with back end programs. Strict interpretation of HTTP get methods means that these HTTP Get services should not be used to delete information on the server, but there is no access control mechanism to back up this logic. This means that unless the services are properly ACL'd and the application's service implementation are following these guidelines then an HTTP request can easily execute a delete or update on the server side. The attacker identifies a HTTP Get URL such as http://victimsite/updateOrder, which calls out to a program to update orders on a database or other resource. The URL is not idempotent so the request can be submitted multiple times by the attacker, additionally, the attacker may be able to exploit the URL published as a Get method that actually performs updates (instead of merely retrieving data). This may result in malicious or inadvertent altering of data on the server.
  • Target Programs with Elevated Privileges
    This attack targets programs running with elevated privileges. The attacker would try to leverage a bug in the running program and get arbitrary code to execute with elevated privileges. For instance an attacker would look for programs that write to the system directories or registry keys (such as HKLM, which stores a number of critical Windows environment variables). These programs are typically running with elevated privileges and have usually not been designed with security in mind. Such programs are excellent exploit targets because they yield lots of power when they break. The malicious user try to execute its code at the same level as a privileged system call.

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2010-2720.NASL
    descriptionhttp://curl.haxx.se/docs/adv_20100209.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id47292
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/47292
    titleFedora 11 : curl-7.19.7-5.fc11 (2010-2720)
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Fedora Security Advisory 2010-2720.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(47292);
      script_version("1.11");
      script_cvs_date("Date: 2019/08/02 13:32:32");
    
      script_cve_id("CVE-2010-0734");
      script_bugtraq_id(38162);
      script_xref(name:"FEDORA", value:"2010-2720");
    
      script_name(english:"Fedora 11 : curl-7.19.7-5.fc11 (2010-2720)");
      script_summary(english:"Checks rpm output for the updated package.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Fedora host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "http://curl.haxx.se/docs/adv_20100209.html
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Fedora security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      # http://curl.haxx.se/docs/adv_20100209.html
      script_set_attribute(
        attribute:"see_also",
        value:"https://curl.haxx.se/docs/CVE-2010-0734.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.redhat.com/show_bug.cgi?id=563220"
      );
      # https://lists.fedoraproject.org/pipermail/package-announce/2010-March/037143.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?7e63000c"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected curl package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:curl");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:11");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/02/24");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/07/01");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Fedora Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
    os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
    os_ver = os_ver[1];
    if (! ereg(pattern:"^11([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 11.x", "Fedora " + os_ver);
    
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);
    
    flag = 0;
    if (rpm_check(release:"FC11", reference:"curl-7.19.7-5.fc11")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "curl");
    }
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2023.NASL
    descriptionWesley Miaw discovered that libcurl, a multi-protocol file transfer library, is prone to a buffer overflow via the callback function when an application relies on libcurl to automatically uncompress data. Note that this only affects applications that trust libcurl
    last seen2020-06-01
    modified2020-06-02
    plugin id45369
    published2010-03-29
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/45369
    titleDebian DSA-2023-1 : curl - buffer overflow
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Debian Security Advisory DSA-2023. The text 
    # itself is copyright (C) Software in the Public Interest, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(45369);
      script_version("1.11");
      script_cvs_date("Date: 2019/08/02 13:32:22");
    
      script_cve_id("CVE-2010-0734");
      script_bugtraq_id(38162);
      script_xref(name:"DSA", value:"2023");
    
      script_name(english:"Debian DSA-2023-1 : curl - buffer overflow");
      script_summary(english:"Checks dpkg output for the updated package");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote Debian host is missing a security-related update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Wesley Miaw discovered that libcurl, a multi-protocol file transfer
    library, is prone to a buffer overflow via the callback function when
    an application relies on libcurl to automatically uncompress data.
    Note that this only affects applications that trust libcurl's maximum
    limit for a fixed buffer size and do not perform any sanity checks
    themselves."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.debian.org/security/2010/dsa-2023"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "Upgrade the curl packages.
    
    For the stable distribution (lenny), this problem has been fixed in
    version 7.18.2-8lenny4.
    
    Due to a problem with the archive software, we are unable to release
    all architectures simultaneously. Binaries for the hppa, ia64, mips,
    mipsel and s390 architectures will be provided once they are
    available."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:curl");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:5.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/03/28");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/03/29");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Debian Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("debian_package.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"5.0", prefix:"curl", reference:"7.18.2-8lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"libcurl3", reference:"7.18.2-8lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"libcurl3-dbg", reference:"7.18.2-8lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"libcurl3-gnutls", reference:"7.18.2-8lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"libcurl4-gnutls-dev", reference:"7.18.2-8lenny4")) flag++;
    if (deb_check(release:"5.0", prefix:"libcurl4-openssl-dev", reference:"7.18.2-8lenny4")) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2010-062.NASL
    descriptionA vulnerability has been found and corrected in curl : content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit (CVE-2010-0734). Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers. The updated packages have been patched to correct theis issue.
    last seen2020-06-01
    modified2020-06-02
    plugin id45115
    published2010-03-22
    reporterThis script is Copyright (C) 2010-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/45115
    titleMandriva Linux Security Advisory : curl (MDVSA-2010:062)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandriva Linux Security Advisory MDVSA-2010:062. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(45115);
      script_version("1.13");
      script_cvs_date("Date: 2019/08/02 13:32:53");
    
      script_cve_id("CVE-2010-0734");
      script_bugtraq_id(38162);
      script_xref(name:"MDVSA", value:"2010:062");
    
      script_name(english:"Mandriva Linux Security Advisory : curl (MDVSA-2010:062)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandriva Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "A vulnerability has been found and corrected in curl :
    
    content_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is
    enabled, does not properly restrict the amount of callback data sent
    to an application that requests automatic decompression, which might
    allow remote attackers to cause a denial of service (application
    crash) or have unspecified other impact by sending crafted compressed
    data to an application that relies on the intended data-length limit
    (CVE-2010-0734).
    
    Packages for 2008.0 are provided for Corporate Desktop 2008.0
    customers.
    
    The updated packages have been patched to correct theis issue."
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:ND/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:curl");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:curl-examples");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64curl-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:lib64curl4");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libcurl-devel");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:libcurl4");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2008.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2009.0");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2009.1");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:linux:2010.0");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/03/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2010/03/22");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2010-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK2008.0", reference:"curl-7.16.4-2.3mdv2008.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2008.0", cpu:"x86_64", reference:"lib64curl-devel-7.16.4-2.3mdv2008.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2008.0", cpu:"x86_64", reference:"lib64curl4-7.16.4-2.3mdv2008.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2008.0", cpu:"i386", reference:"libcurl-devel-7.16.4-2.3mdv2008.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2008.0", cpu:"i386", reference:"libcurl4-7.16.4-2.3mdv2008.0", yank:"mdv")) flag++;
    
    if (rpm_check(release:"MDK2009.0", reference:"curl-7.19.0-2.4mdv2009.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2009.0", reference:"curl-examples-7.19.0-2.4mdv2009.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2009.0", cpu:"x86_64", reference:"lib64curl-devel-7.19.0-2.4mdv2009.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2009.0", cpu:"x86_64", reference:"lib64curl4-7.19.0-2.4mdv2009.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2009.0", cpu:"i386", reference:"libcurl-devel-7.19.0-2.4mdv2009.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2009.0", cpu:"i386", reference:"libcurl4-7.19.0-2.4mdv2009.0", yank:"mdv")) flag++;
    
    if (rpm_check(release:"MDK2009.1", reference:"curl-7.19.4-1.1mdv2009.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2009.1", reference:"curl-examples-7.19.4-1.1mdv2009.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2009.1", cpu:"x86_64", reference:"lib64curl-devel-7.19.4-1.1mdv2009.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2009.1", cpu:"x86_64", reference:"lib64curl4-7.19.4-1.1mdv2009.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2009.1", cpu:"i386", reference:"libcurl-devel-7.19.4-1.1mdv2009.1", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2009.1", cpu:"i386", reference:"libcurl4-7.19.4-1.1mdv2009.1", yank:"mdv")) flag++;
    
    if (rpm_check(release:"MDK2010.0", reference:"curl-7.19.6-3.1mdv2010.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.0", reference:"curl-examples-7.19.6-3.1mdv2010.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.0", cpu:"x86_64", reference:"lib64curl-devel-7.19.6-3.1mdv2010.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.0", cpu:"x86_64", reference:"lib64curl4-7.19.6-3.1mdv2010.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.0", cpu:"i386", reference:"libcurl-devel-7.19.6-3.1mdv2010.0", yank:"mdv")) flag++;
    if (rpm_check(release:"MDK2010.0", cpu:"i386", reference:"libcurl4-7.19.6-3.1mdv2010.0", yank:"mdv")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20100330_CURL_ON_SL3_X.NASL
    descriptionWesley Miaw discovered that when deflate compression was used, libcurl could call the registered write callback function with data exceeding the documented limit. A malicious server could use this flaw to crash an application using libcurl or, potentially, execute arbitrary code. Note: This issue only affected applications using libcurl that rely on the documented data size limit, and that copy the data to the insufficiently sized buffer. (CVE-2010-0734) All running applications using libcurl must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id60763
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60763
    titleScientific Linux Security Update : curl on SL3.x i386/x86_64
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text is (C) Scientific Linux.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(60763);
      script_version("1.4");
      script_cvs_date("Date: 2019/10/25 13:36:18");
    
      script_cve_id("CVE-2010-0734");
    
      script_name(english:"Scientific Linux Security Update : curl on SL3.x i386/x86_64");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Scientific Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Wesley Miaw discovered that when deflate compression was used, libcurl
    could call the registered write callback function with data exceeding
    the documented limit. A malicious server could use this flaw to crash
    an application using libcurl or, potentially, execute arbitrary code.
    Note: This issue only affected applications using libcurl that rely on
    the documented data size limit, and that copy the data to the
    insufficiently sized buffer. (CVE-2010-0734)
    
    All running applications using libcurl must be restarted for the
    update to take effect."
      );
      # https://listserv.fnal.gov/scripts/wa.exe?A2=ind1003&L=scientific-linux-errata&T=0&P=3701
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?df036ef4"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected curl and / or curl-devel packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"x-cpe:/o:fermilab:scientific_linux");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2010/03/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/08/01");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Scientific Linux Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/RedHat/release", "Host/RedHat/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/RedHat/release");
    if (isnull(release) || "Scientific Linux " >!< release) audit(AUDIT_HOST_NOT, "running Scientific Linux");
    if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Scientific Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"SL3", reference:"curl-7.10.6-11.rhel3")) flag++;
    if (rpm_check(release:"SL3", reference:"curl-devel-7.10.6-11.rhel3")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyWeb Servers
    NASL idHPSMH_7_0_0_24.NASL
    descriptionAccording to the web server
    last seen2020-06-01
    modified2020-06-02
    plugin id58811
    published2012-04-20
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58811
    titleHP System Management Homepage < 7.0 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    
    include("compat.inc");
    
    
    if (description)
    {
      script_id(58811);
      script_version("1.26");
      script_cvs_date("Date: 2018/11/15 20:50:25");
    
      script_cve_id(
        "CVE-2009-0037",
        "CVE-2010-0734",
        "CVE-2010-1452",
        "CVE-2010-1623",
        "CVE-2010-2068",
        "CVE-2010-2791",
        "CVE-2010-3436",
        "CVE-2010-4409",
        "CVE-2010-4645",
        "CVE-2011-0014",
        "CVE-2011-0195",
        "CVE-2011-0419",
        "CVE-2011-1148",
        "CVE-2011-1153",
        "CVE-2011-1464",
        "CVE-2011-1467",
        "CVE-2011-1468",
        "CVE-2011-1470",
        "CVE-2011-1471",
        "CVE-2011-1928",
        "CVE-2011-1938",
        "CVE-2011-1945",
        "CVE-2011-2192",
        "CVE-2011-2202",
        "CVE-2011-2483",
        "CVE-2011-3182",
        "CVE-2011-3189",
        "CVE-2011-3192",
        "CVE-2011-3207",
        "CVE-2011-3210",
        "CVE-2011-3267",
        "CVE-2011-3268",
        "CVE-2011-3348",
        "CVE-2011-3368",
        "CVE-2011-3639",
        "CVE-2011-3846",
        "CVE-2012-0135",
        "CVE-2012-1993"
      );
      script_bugtraq_id(
        33962,
        38162,
        40827,
        41963,
        42102,
        43673,
        44723,
        45119,
        45668,
        46264,
        46843,
        46854,
        46968,
        46969,
        46975,
        46977,
        47668,
        47820,
        47888,
        47929,
        47950,
        48259,
        48434,
        49241,
        49249,
        49303,
        49376,
        49469,
        49471,
        49616,
        49957,
        52974,
        53121
      );
    
      script_name(english:"HP System Management Homepage < 7.0 Multiple Vulnerabilities");
      script_summary(english:"Does a banner check");
    
      script_set_attribute(
        attribute:"synopsis",
        value:"The remote web server is affected by multiple vulnerabilities."
      );
      script_set_attribute(
        attribute:"description",
        value:
    "According to the web server's banner, the version of HP System
    Management Homepage (SMH) hosted on the remote host is earlier than
    7.0.  As such, it is reportedly affected by the following
    vulnerabilities :
    
     - An error exists in the 'generate-id' function in the
       bundled libxslt library that can allow disclosure of
       heap memory addresses. (CVE-2011-0195)
    
     - An unspecified input validation error exists and can
       allow cross-site request forgery attacks. (CVE-2011-3846)
    
     - Unspecified errors can allow attackers to carry out 
       denial of service attacks via unspecified vectors.
       (CVE-2012-0135, CVE-2012-1993)
    
     - The bundled version of PHP contains multiple
       vulnerabilities. (CVE-2010-3436, CVE-2010-4409,
       CVE-2010-4645, CVE-2011-1148, CVE-2011-1153,
       CVE-2011-1464, CVE-2011-1467, CVE-2011-1468,
       CVE-2011-1470, CVE-2011-1471, CVE-2011-1938,
       CVE-2011-2202, CVE-2011-2483, CVE-2011-3182,
       CVE-2011-3189, CVE-2011-3267, CVE-2011-3268)
    
     - The bundled version of Apache contains multiple
       vulnerabilities. (CVE-2010-1452, CVE-2010-1623,
       CVE-2010-2068,  CVE-2010-2791, CVE-2011-0419,
       CVE-2011-1928, CVE-2011-3192, CVE-2011-3348,
       CVE-2011-3368, CVE-2011-3639)
    
     - OpenSSL libraries are contained in several of the
       bundled components and contain multiple vulnerabilities.
       (CVE-2011-0014, CVE-2011-1468, CVE-2011-1945,
       CVE-2011-3207,CVE-2011-3210)
    
     - Curl libraries are contained in several of the bundled
       components and contain multiple vulnerabilities.
       (CVE-2009-0037, CVE-2010-0734, CVE-2011-2192)"
      );
      script_set_attribute(
        attribute:"see_also", 
        value:"http://www.nessus.org/u?106ec533"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Upgrade to HP System Management Homepage 7.0 or later."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"exploithub_sku", value:"EH-14-410");
      script_set_attribute(attribute:"exploit_framework_exploithub", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
      script_cwe_id(352);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/04/16");
      script_set_attribute(attribute:"patch_publication_date", value:"2012/04/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2012/04/20");
    
      script_set_attribute(attribute:"cpe", value:"cpe:/a:hp:system_management_homepage");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Web Servers");
    
      script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
    
      script_dependencies("compaq_wbem_detect.nasl");
      script_require_keys("www/hp_smh");
      script_require_ports("Services/www", 2301, 2381);
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("audit.inc");
    include("misc_func.inc");
    include("http.inc");
    include("webapp_func.inc");
    
    
    port    = get_http_port(default:2381, embedded:TRUE);
    install = get_install_from_kb(appname:'hp_smh', port:port, exit_on_fail:TRUE);
    dir     = install['dir'];
    version = install['ver'];
    prod    = get_kb_item_or_exit("www/"+port+"/hp_smh/variant");
    
    if (version == UNKNOWN_VER) 
      exit(1, 'The version of '+prod+' installed at '+build_url(port:port, qs:dir+"/")+' is unknown.');
    
    # nb: 'version' can have non-numeric characters in it so we'll create 
    #     an alternate form and make sure that's safe for use in 'ver_compare()'.
    version_alt = ereg_replace(pattern:"[_-]", replace:".", string:version);
    if (!ereg(pattern:"^[0-9][0-9.]+$", string:version_alt))
      exit(1, 'The version of '+prod+' installed at '+build_url(port:port, qs:dir+"/")+' does not look valid ('+version+').');
    
    fixed_version = '7.0.0.24';
    if (ver_compare(ver:version_alt, fix:fixed_version, strict:FALSE) == -1)
    {
      set_kb_item(name:'www/'+port+'/XSS', value:TRUE);
      set_kb_item(name:'www/'+port+'/XSRF', value:TRUE);
      if (report_verbosity > 0)
      {
        source_line = get_kb_item("www/"+port+"/hp_smh/source");
    
        report = '\n  Product           : ' + prod;
        if (!isnull(source_line)) 
          report += '\n  Version source    : ' + source_line;
        report += 
          '\n  Installed version : ' + version +
          '\n  Fixed version     : ' + fixed_version + '\n';
        security_hole(port:port, extra:report);
      }
      else security_hole(port);
    
      exit(0);
    }
    else audit(AUDIT_LISTEN_NOT_VULN, prod, port, version);
    
  • NASL familyVMware ESX Local Security Checks
    NASL idVMWARE_VMSA-2011-0003.NASL
    descriptiona. vCenter Server and vCenter Update Manager update Microsoft SQL Server 2005 Express Edition to Service Pack 3 Microsoft SQL Server 2005 Express Edition (SQL Express) distributed with vCenter Server 4.1 Update 1 and vCenter Update Manager 4.1 Update 1 is upgraded from SQL Express Service Pack 2 to SQL Express Service Pack 3, to address multiple security issues that exist in the earlier releases of Microsoft SQL Express. Customers using other database solutions need not update for these issues. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-5416, CVE-2008-0085, CVE-2008-0086, CVE-2008-0107 and CVE-2008-0106 to the issues addressed in MS SQL Express Service Pack 3. b. vCenter Apache Tomcat Management Application Credential Disclosure The Apache Tomcat Manager application configuration file contains logon credentials that can be read by unprivileged local users. The issue is resolved by removing the Manager application in vCenter 4.1 Update 1. If vCenter 4.1 is updated to vCenter 4.1 Update 1 the logon credentials are not present in the configuration file after the update. VMware would like to thank Claudio Criscione of Secure Networking for reporting this issue to us. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2010-2928 to this issue. c. vCenter Server and ESX, Oracle (Sun) JRE is updated to version 1.6.0_21 Oracle (Sun) JRE update to version 1.6.0_21, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.6.0_19: CVE-2009-3555, CVE-2010-0082, CVE-2010-0084, CVE-2010-0085, CVE-2010-0087, CVE-2010-0088, CVE-2010-0089, CVE-2010-0090, CVE-2010-0091, CVE-2010-0092, CVE-2010-0093, CVE-2010-0094, CVE-2010-0095, CVE-2010-0837, CVE-2010-0838, CVE-2010-0839, CVE-2010-0840, CVE-2010-0841, CVE-2010-0842, CVE-2010-0843, CVE-2010-0844, CVE-2010-0845, CVE-2010-0846, CVE-2010-0847, CVE-2010-0848, CVE-2010-0849, CVE-2010-0850. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following name to the security issue fixed in Oracle (Sun) JRE 1.6.0_20: CVE-2010-0886. d. vCenter Update Manager Oracle (Sun) JRE is updated to version 1.5.0_26 Oracle (Sun) JRE update to version 1.5.0_26, which addresses multiple security issues that existed in earlier releases of Oracle (Sun) JRE. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Oracle (Sun) JRE 1.5.0_26: CVE-2010-3556, CVE-2010-3566, CVE-2010-3567, CVE-2010-3550, CVE-2010-3561, CVE-2010-3573, CVE-2010-3565,CVE-2010-3568, CVE-2010-3569, CVE-2009-3555, CVE-2010-1321, CVE-2010-3548, CVE-2010-3551, CVE-2010-3562, CVE-2010-3571, CVE-2010-3554, CVE-2010-3559, CVE-2010-3572, CVE-2010-3553, CVE-2010-3549, CVE-2010-3557, CVE-2010-3541, CVE-2010-3574. e. vCenter Server and ESX Apache Tomcat updated to version 6.0.28 Apache Tomcat updated to version 6.0.28, which addresses multiple security issues that existed in earlier releases of Apache Tomcat The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Apache Tomcat 6.0.24: CVE-2009-2693, CVE-2009-2901, CVE-2009-2902,i and CVE-2009-3548. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the following names to the security issues fixed in Apache Tomcat 6.0.28: CVE-2010-2227, CVE-2010-1157. f. vCenter Server third-party component OpenSSL updated to version 0.9.8n The version of the OpenSSL library in vCenter Server is updated to 0.9.8n. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-0740 and CVE-2010-0433 to the issues addressed in this version of OpenSSL. g. ESX third-party component OpenSSL updated to version 0.9.8p The version of the ESX OpenSSL library is updated to 0.9.8p. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-3864 and CVE-2010-2939 to the issues addressed in this update. h. ESXi third-party component cURL updated The version of cURL library in ESXi is updated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-0734 to the issues addressed in this update. i. ESX third-party component pam_krb5 updated The version of pam_krb5 library is updated. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2008-3825 and CVE-2009-1384 to the issues addressed in the update. j. ESX third-party update for Service Console kernel The Service Console kernel is updated to include kernel version 2.6.18-194.11.1. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2010-1084, CVE-2010-2066, CVE-2010-2070, CVE-2010-2226, CVE-2010-2248, CVE-2010-2521, CVE-2010-2524, CVE-2010-0008, CVE-2010-0415, CVE-2010-0437, CVE-2009-4308, CVE-2010-0003, CVE-2010-0007, CVE-2010-0307, CVE-2010-1086, CVE-2010-0410, CVE-2010-0730, CVE-2010-1085, CVE-2010-0291, CVE-2010-0622, CVE-2010-1087, CVE-2010-1173, CVE-2010-1437, CVE-2010-1088, CVE-2010-1187, CVE-2010-1436, CVE-2010-1641, and CVE-2010-3081 to the issues addressed in the update. Notes : - The update also addresses the 64-bit compatibility mode stack pointer underflow issue identified by CVE-2010-3081. This issue was patched in an ESX 4.1 patch prior to the release of ESX 4.1 Update 1 and in a previous ESX 4.0 patch release. - The update also addresses CVE-2010-2240 for ESX 4.0.
    last seen2020-06-01
    modified2020-06-02
    plugin id51971
    published2011-02-14
    reporterThis script is Copyright (C) 2011-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/51971
    titleVMSA-2011-0003 : Third-party component updates for VMware vCenter Server, vCenter Update Manager, ESXi and ESX
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-1158-1.NASL
    descriptionRichard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation, handing the server a copy of the client
    last seen2020-06-01
    modified2020-06-02
    plugin id55414
    published2011-06-24
    reporterUbuntu Security Notice (C) 2011-2019 Canonical, Inc. / NASL script (C) 2011-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/55414
    titleUbuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : curl vulnerabilities (USN-1158-1)
  • NASL familyMisc.
    NASL idVMWARE_VMSA-2011-0003_REMOTE.NASL
    descriptionThe remote VMware ESX / ESXi host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries : - Apache Tomcat - Apache Tomcat Manager - cURL - Java Runtime Environment (JRE) - Kernel - Microsoft SQL Express - OpenSSL - pam_krb5
    last seen2020-06-01
    modified2020-06-02
    plugin id89674
    published2016-03-04
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89674
    titleVMware ESX / ESXi Third-Party Libraries Multiple Vulnerabilities (VMSA-2011-0003) (remote check)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2010-0273.NASL
    descriptionUpdated curl packages that fix one security issue, various bugs, and add enhancements are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and DICT servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. Wesley Miaw discovered that when deflate compression was used, libcurl could call the registered write callback function with data exceeding the documented limit. A malicious server could use this flaw to crash an application using libcurl or, potentially, execute arbitrary code. Note: This issue only affected applications using libcurl that rely on the documented data size limit, and that copy the data to the insufficiently sized buffer. (CVE-2010-0734) This update also fixes the following bugs : * when using curl to upload a file, if the connection was broken or reset by the server during the transfer, curl immediately started using 100% CPU and failed to acknowledge that the transfer had failed. With this update, curl displays an appropriate error message and exits when an upload fails mid-transfer due to a broken or reset connection. (BZ#479967) * libcurl experienced a segmentation fault when attempting to reuse a connection after performing GSS-negotiate authentication, which in turn caused the curl program to crash. This update fixes this bug so that reused connections are able to be successfully established even after GSS-negotiate authentication has been performed. (BZ#517199) As well, this update adds the following enhancements : * curl now supports loading Certificate Revocation Lists (CRLs) from a Privacy Enhanced Mail (PEM) file. When curl attempts to access sites that have had their certificate revoked in a CRL, curl refuses access to those sites. (BZ#532069) * the curl(1) manual page has been updated to clarify that the
    last seen2020-06-01
    modified2020-06-02
    plugin id46288
    published2010-05-11
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46288
    titleRHEL 5 : curl (RHSA-2010:0273)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20100330_CURL_ON_SL5_X.NASL
    descriptionWesley Miaw discovered that when deflate compression was used, libcurl could call the registered write callback function with data exceeding the documented limit. A malicious server could use this flaw to crash an application using libcurl or, potentially, execute arbitrary code. Note: This issue only affected applications using libcurl that rely on the documented data size limit, and that copy the data to the insufficiently sized buffer. (CVE-2010-0734) This update also fixes the following bugs : - when using curl to upload a file, if the connection was broken or reset by the server during the transfer, curl immediately started using 100% CPU and failed to acknowledge that the transfer had failed. With this update, curl displays an appropriate error message and exits when an upload fails mid-transfer due to a broken or reset connection. (BZ#479967) - libcurl experienced a segmentation fault when attempting to reuse a connection after performing GSS-negotiate authentication, which in turn caused the curl program to crash. This update fixes this bug so that reused connections are able to be successfully established even after GSS-negotiate authentication has been performed. (BZ#517199) As well, this update adds the following enhancements : - curl now supports loading Certificate Revocation Lists (CRLs) from a Privacy Enhanced Mail (PEM) file. When curl attempts to access sites that have had their certificate revoked in a CRL, curl refuses access to those sites. (BZ#532069) - the curl(1) manual page has been updated to clarify that the
    last seen2020-06-01
    modified2020-06-02
    plugin id60765
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60765
    titleScientific Linux Security Update : curl on SL5.x i386/x86_64
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_C8C31C4149ED11DF83FB0015587E2CC1.NASL
    descriptionThe cURL project reports in a security advisory : Using the affected libcurl version to download compressed content over HTTP, an application can ask libcurl to automatically uncompress data. When doing so, libcurl can wrongly send data up to 64K in size to the callback which thus is much larger than the documented maximum size. An application that blindly trusts libcurl
    last seen2020-06-01
    modified2020-06-02
    plugin id45574
    published2010-04-20
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/45574
    titleFreeBSD : curl -- libcurl buffer overflow vulnerability (c8c31c41-49ed-11df-83fb-0015587e2cc1)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_10_6_4.NASL
    descriptionThe remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.4. Mac OS X 10.6.4 contains security fixes for the following components : - CUPS - DesktopServices - Flash Player plug-in - Folder Manager - Help Viewer - iChat - ImageIO - Kerberos - Kernel - libcurl - Network Authorization - Open Directory - Printer Setup - Printing - Ruby - SMB File Server - SquirrelMail - Wiki Server
    last seen2020-06-01
    modified2020-06-02
    plugin id47023
    published2010-06-15
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/47023
    titleMac OS X 10.6.x < 10.6.4 Multiple Vulnerabilities
  • NASL familyVMware ESX Local Security Checks
    NASL idVMWARE_VMSA-2010-0015.NASL
    descriptiona. Service Console update for NSS_db The service console package NSS_db is updated to version nss_db-2.2-35.4.el5_5. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-0826 to this issue. b. Service Console update for OpenLDAP The service console package OpenLDAP updated to version 2.3.43-12.el5. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-3767 to this issue. c. Service Console update for cURL The service console packages for cURL updated to version 7.15.5-9.el5. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-0734 to this issue. d. Service Console update for sudo The service console package sudo updated to version 1.7.2p1-7.el5_5. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-1646 to this issue. e. Service Console update for OpenSSL, GnuTLS, NSS and NSPR Service Console updates for OpenSSL to version 097a-0.9.7a-9.el5_4.2 and version 0.9.8e-12.el5_4.6, GnuTLS to version 1.4.1-3.el5_4.8, and NSS to version 3.12.6-1.3235.vmw and NSPR to version 4.8.4-1.3235.vmw. These four updates are bundled together due to their mutual dependencies. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2009-3555, CVE-2009-2409, CVE-2009-3245 and CVE-2010-0433 to the issues addressed in this update.
    last seen2020-06-01
    modified2020-06-02
    plugin id49703
    published2010-10-04
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/49703
    titleVMSA-2010-0015 : VMware ESX third-party updates for Service Console
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2010-0329.NASL
    descriptionFrom Red Hat Security Advisory 2010:0329 : Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 3 and 4. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and DICT servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. Wesley Miaw discovered that when deflate compression was used, libcurl could call the registered write callback function with data exceeding the documented limit. A malicious server could use this flaw to crash an application using libcurl or, potentially, execute arbitrary code. Note: This issue only affected applications using libcurl that rely on the documented data size limit, and that copy the data to the insufficiently sized buffer. (CVE-2010-0734) Users of curl should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libcurl must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id68025
    published2013-07-12
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/68025
    titleOracle Linux 3 / 4 : curl (ELSA-2010-0329)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2010-0329.NASL
    descriptionUpdated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 3 and 4. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and DICT servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. Wesley Miaw discovered that when deflate compression was used, libcurl could call the registered write callback function with data exceeding the documented limit. A malicious server could use this flaw to crash an application using libcurl or, potentially, execute arbitrary code. Note: This issue only affected applications using libcurl that rely on the documented data size limit, and that copy the data to the insufficiently sized buffer. (CVE-2010-0734) Users of curl should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libcurl must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id45442
    published2010-04-09
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/45442
    titleCentOS 3 / 4 : curl (CESA-2010:0329)
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2010-2762.NASL
    descriptionhttp://curl.haxx.se/docs/adv_20100209.html Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id47295
    published2010-07-01
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/47295
    titleFedora 12 : curl-7.19.7-7.fc12 (2010-2762)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201203-02.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201203-02 (cURL: Multiple vulnerabilities) Multiple vulnerabilities have been found in cURL: When zlib is enabled, the amount of data sent to an application for automatic decompression is not restricted (CVE-2010-0734). When performing GSSAPI authentication, credential delegation is always used (CVE-2011-2192). When SSL is enabled, cURL improperly disables the OpenSSL workaround to mitigate an information disclosure vulnerability in the SSL and TLS protocols (CVE-2011-3389). libcurl does not properly verify file paths for escape control characters in IMAP, POP3 or SMTP URLs (CVE-2012-0036). Impact : A remote attacker could entice a user or automated process to open a specially crafted file or URL using cURL, possibly resulting in the remote execution of arbitrary code, a Denial of Service condition, disclosure of sensitive information, or unwanted actions performed via the IMAP, POP3 or SMTP protocols. Furthermore, remote servers may be able to impersonate clients via GSSAPI requests. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id58212
    published2012-03-06
    reporterThis script is Copyright (C) 2012-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/58212
    titleGLSA-201203-02 : cURL: Multiple vulnerabilities (BEAST)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20100330_CURL_ON_SL4_X.NASL
    descriptionWesley Miaw discovered that when deflate compression was used, libcurl could call the registered write callback function with data exceeding the documented limit. A malicious server could use this flaw to crash an application using libcurl or, potentially, execute arbitrary code. Note: This issue only affected applications using libcurl that rely on the documented data size limit, and that copy the data to the insufficiently sized buffer. (CVE-2010-0734) All running applications using libcurl must be restarted for the update to take effect. Note: This package for SL4 has to be renamed due to previous poor naming of rpms.
    last seen2020-06-01
    modified2020-06-02
    plugin id60764
    published2012-08-01
    reporterThis script is Copyright (C) 2012-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/60764
    titleScientific Linux Security Update : curl on SL4.x i386/x86_64
  • NASL familyVMware ESX Local Security Checks
    NASL idVMWARE_VMSA-2010-0015_REMOTE.NASL
    descriptionThe remote VMware ESX host is missing a security-related patch. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several third-party components and libraries : - Berkeley DB NSS module - cURL / libcURL - GnuTLS - Network Security Services (NSS) Library - OpenLDAP - OpenSSL - OpenSSL Kerberos - sudo
    last seen2020-06-01
    modified2020-06-02
    plugin id89742
    published2016-03-08
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/89742
    titleVMware ESX Multiple Vulnerabilities (VMSA-2010-0015) (remote check)
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2010-004.NASL
    descriptionThe remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-004 applied. This security update contains fixes for the following components : - CUPS - DesktopServices - Flash Player plug-in - Folder Manager - iChat - ImageIO - Kerberos - Kernel - libcurl - Network Authorization - Ruby - SMB File Server - SquirrelMail - Wiki Server
    last seen2020-06-01
    modified2020-06-02
    plugin id47024
    published2010-06-15
    reporterThis script is Copyright (C) 2010-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/47024
    titleMac OS X Multiple Vulnerabilities (Security Update 2010-004)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2010-0329.NASL
    descriptionUpdated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 3 and 4. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and DICT servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity. Wesley Miaw discovered that when deflate compression was used, libcurl could call the registered write callback function with data exceeding the documented limit. A malicious server could use this flaw to crash an application using libcurl or, potentially, execute arbitrary code. Note: This issue only affected applications using libcurl that rely on the documented data size limit, and that copy the data to the insufficiently sized buffer. (CVE-2010-0734) Users of curl should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libcurl must be restarted for the update to take effect.
    last seen2020-06-01
    modified2020-06-02
    plugin id46290
    published2010-05-11
    reporterThis script is Copyright (C) 2010-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/46290
    titleRHEL 3 / 4 : curl (RHSA-2010:0329)

Oval

  • accepted2013-04-29T04:08:27.883-04:00
    classvulnerability
    contributors
    • nameAharon Chernin
      organizationSCAP.com, LLC
    • nameDragos Prisaca
      organizationG2, Inc.
    definition_extensions
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 3
      ovaloval:org.mitre.oval:def:11782
    • commentCentOS Linux 3.x
      ovaloval:org.mitre.oval:def:16651
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 4
      ovaloval:org.mitre.oval:def:11831
    • commentCentOS Linux 4.x
      ovaloval:org.mitre.oval:def:16636
    • commentOracle Linux 4.x
      ovaloval:org.mitre.oval:def:15990
    • commentThe operating system installed on the system is Red Hat Enterprise Linux 5
      ovaloval:org.mitre.oval:def:11414
    • commentThe operating system installed on the system is CentOS Linux 5.x
      ovaloval:org.mitre.oval:def:15802
    • commentOracle Linux 5.x
      ovaloval:org.mitre.oval:def:15459
    descriptioncontent_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.
    familyunix
    idoval:org.mitre.oval:def:10760
    statusaccepted
    submitted2010-07-09T03:56:16-04:00
    titlecontent_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.
    version27
  • accepted2014-01-20T04:01:29.387-05:00
    classvulnerability
    contributors
    • nameVarun
      organizationHewlett-Packard
    • nameChris Coffin
      organizationThe MITRE Corporation
    definition_extensions
    commentVMware ESX Server 4.0 is installed
    ovaloval:org.mitre.oval:def:6293
    descriptioncontent_encoding.c in libcurl 7.10.5 through 7.19.7, when zlib is enabled, does not properly restrict the amount of callback data sent to an application that requests automatic decompression, which might allow remote attackers to cause a denial of service (application crash) or have unspecified other impact by sending crafted compressed data to an application that relies on the intended data-length limit.
    familyunix
    idoval:org.mitre.oval:def:6756
    statusaccepted
    submitted2010-10-04T11:07:15.000-05:00
    titleVMware ESX, Service Console update for cURL.
    version7

Redhat

advisories
  • bugzilla
    id563220
    titleCVE-2010-0734 curl: zlib-compression causes curl to pass more than CURL_MAX_WRITE_SIZE bytes to write callback
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 5 is installed
        ovaloval:com.redhat.rhba:tst:20070331005
      • OR
        • AND
          • commentcurl is earlier than 0:7.15.5-9.el5
            ovaloval:com.redhat.rhsa:tst:20100273001
          • commentcurl is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20090341007
        • AND
          • commentcurl-devel is earlier than 0:7.15.5-9.el5
            ovaloval:com.redhat.rhsa:tst:20100273003
          • commentcurl-devel is signed with Red Hat redhatrelease key
            ovaloval:com.redhat.rhsa:tst:20090341009
    rhsa
    idRHSA-2010:0273
    released2010-03-29
    severityModerate
    titleRHSA-2010:0273: curl security, bug fix and enhancement update (Moderate)
  • bugzilla
    id563220
    titleCVE-2010-0734 curl: zlib-compression causes curl to pass more than CURL_MAX_WRITE_SIZE bytes to write callback
    oval
    OR
    • commentRed Hat Enterprise Linux must be installed
      ovaloval:com.redhat.rhba:tst:20070304026
    • AND
      • commentRed Hat Enterprise Linux 4 is installed
        ovaloval:com.redhat.rhba:tst:20070304025
      • OR
        • AND
          • commentcurl is earlier than 0:7.12.1-11.1.el4_8.3
            ovaloval:com.redhat.rhsa:tst:20100329001
          • commentcurl is signed with Red Hat master key
            ovaloval:com.redhat.rhsa:tst:20090341004
        • AND
          • commentcurl-devel is earlier than 0:7.12.1-11.1.el4_8.3
            ovaloval:com.redhat.rhsa:tst:20100329003
          • commentcurl-devel is signed with Red Hat master key
            ovaloval:com.redhat.rhsa:tst:20090341002
    rhsa
    idRHSA-2010:0329
    released2010-03-30
    severityModerate
    titleRHSA-2010:0329: curl security update (Moderate)
rpms
  • curl-0:7.15.5-9.el5
  • curl-debuginfo-0:7.15.5-9.el5
  • curl-devel-0:7.15.5-9.el5
  • curl-0:7.10.6-11.rhel3
  • curl-0:7.12.1-11.1.el4_8.3
  • curl-debuginfo-0:7.10.6-11.rhel3
  • curl-debuginfo-0:7.12.1-11.1.el4_8.3
  • curl-devel-0:7.10.6-11.rhel3
  • curl-devel-0:7.12.1-11.1.el4_8.3

References