Vulnerabilities > CVE-2013-2174 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in multiple products
Attack vector
NETWORK Attack complexity
MEDIUM Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
PARTIAL Summary
Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a "%" (percent) character.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Overflow Buffers Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
- Client-side Injection-induced Buffer Overflow This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
- Filter Failure through Buffer Overflow In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
- MIME Conversion An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
Nessus
NASL family SuSE Local Security Checks NASL id SUSE_LIBCURL4-8618.NASL description This update of curl fixes several security issues : - libcurl URL decode buffer boundary flaw. (bnc#824517 / CVE-2013-2174) - cookie domain tailmatch. (bnc#814655 / CVE-2013-1944) - curl sets SSL_OP_ALL. (bnc#742306 / CVE-2011-3389) - When SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. (CVE-2010-4180) last seen 2020-06-05 modified 2013-07-10 plugin id 67223 published 2013-07-10 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67223 title SuSE 10 Security Update : libcurl4 (ZYPP Patch Number 8618) (BEAST) code #%NASL_MIN_LEVEL 80502 # # (C) Tenable Network Security, Inc. # # The text description of this plugin is (C) Novell, Inc. # if (NASL_LEVEL < 3000) exit(0); include("compat.inc"); if (description) { script_id(67223); script_version("1.4"); script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04"); script_cve_id("CVE-2010-4180", "CVE-2011-3389", "CVE-2013-1944", "CVE-2013-2174"); script_name(english:"SuSE 10 Security Update : libcurl4 (ZYPP Patch Number 8618) (BEAST)"); script_summary(english:"Checks rpm output for the updated packages"); script_set_attribute( attribute:"synopsis", value:"The remote SuSE 10 host is missing a security-related patch." ); script_set_attribute( attribute:"description", value: "This update of curl fixes several security issues : - libcurl URL decode buffer boundary flaw. (bnc#824517 / CVE-2013-2174) - cookie domain tailmatch. (bnc#814655 / CVE-2013-1944) - curl sets SSL_OP_ALL. (bnc#742306 / CVE-2011-3389) - When SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. (CVE-2010-4180)" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2010-4180.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2011-3389.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-1944.html" ); script_set_attribute( attribute:"see_also", value:"http://support.novell.com/security/cve/CVE-2013-2174.html" ); script_set_attribute(attribute:"solution", value:"Apply ZYPP patch number 8618."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/o:suse:suse_linux"); script_set_attribute(attribute:"vuln_publication_date", value:"2010/12/06"); script_set_attribute(attribute:"patch_publication_date", value:"2013/06/17"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/07/10"); script_set_attribute(attribute:"in_the_news", value:"true"); script_set_attribute(attribute:"generated_plugin", value:"current"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof."); script_family(english:"SuSE Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list"); exit(0); } include("global_settings.inc"); include("rpm.inc"); if (!get_kb_item("Host/local_checks_enabled")) exit(0, "Local checks are not enabled."); if (!get_kb_item("Host/SuSE/release")) exit(0, "The host is not running SuSE."); if (!get_kb_item("Host/SuSE/rpm-list")) exit(1, "Could not obtain the list of installed packages."); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) exit(1, "Failed to determine the architecture type."); if (cpu >!< "x86_64" && cpu !~ "^i[3-6]86$") exit(1, "Local checks for SuSE 10 on the '"+cpu+"' architecture have not been implemented."); flag = 0; if (rpm_check(release:"SLED10", sp:4, cpu:"i586", reference:"libcurl4-7.19.0-11.6.1")) flag++; if (rpm_check(release:"SLED10", sp:4, cpu:"x86_64", reference:"libcurl4-32bit-7.19.0-11.6.1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get()); else security_warning(0); exit(0); } else exit(0, "The host is not affected.");NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2013-174-01.NASL description New curl packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix a security issue. last seen 2020-06-01 modified 2020-06-02 plugin id 66967 published 2013-06-24 reporter This script is Copyright (C) 2013 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/66967 title Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : curl (SSA:2013-174-01) code # # (C) Tenable Network Security, Inc. # # The descriptive text and package checks in this plugin were # extracted from Slackware Security Advisory 2013-174-01. The text # itself is copyright (C) Slackware Linux, Inc. # include("compat.inc"); if (description) { script_id(66967); script_version("$Revision: 1.2 $"); script_cvs_date("$Date: 2013/08/01 10:50:40 $"); script_cve_id("CVE-2013-2174"); script_xref(name:"SSA", value:"2013-174-01"); script_name(english:"Slackware 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / 14.0 / current : curl (SSA:2013-174-01)"); script_summary(english:"Checks for updated package in /var/log/packages"); script_set_attribute( attribute:"synopsis", value:"The remote Slackware host is missing a security update." ); script_set_attribute( attribute:"description", value: "New curl packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37, 14.0, and -current to fix a security issue." ); # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.499592 script_set_attribute( attribute:"see_also", value:"http://www.nessus.org/u?4714fe66" ); script_set_attribute(attribute:"solution", value:"Update the affected curl package."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"p-cpe:/a:slackware:slackware_linux:curl"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:12.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:12.2"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:13.0"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:13.1"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:13.37"); script_set_attribute(attribute:"cpe", value:"cpe:/o:slackware:slackware_linux:14.0"); script_set_attribute(attribute:"patch_publication_date", value:"2013/06/23"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/06/24"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_copyright(english:"This script is Copyright (C) 2013 Tenable Network Security, Inc."); script_family(english:"Slackware Local Security Checks"); script_dependencies("ssh_get_info.nasl"); script_require_keys("Host/local_checks_enabled", "Host/Slackware/release", "Host/Slackware/packages"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("slackware.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); if (!get_kb_item("Host/Slackware/release")) audit(AUDIT_OS_NOT, "Slackware"); if (!get_kb_item("Host/Slackware/packages")) audit(AUDIT_PACKAGE_LIST_MISSING); cpu = get_kb_item("Host/cpu"); if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH); if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Slackware", cpu); flag = 0; if (slackware_check(osver:"12.1", pkgname:"curl", pkgver:"7.16.2", pkgarch:"i486", pkgnum:"4_slack12.1")) flag++; if (slackware_check(osver:"12.2", pkgname:"curl", pkgver:"7.19.6", pkgarch:"i486", pkgnum:"2_slack12.2")) flag++; if (slackware_check(osver:"13.0", pkgname:"curl", pkgver:"7.19.6", pkgarch:"i486", pkgnum:"2_slack13.0")) flag++; if (slackware_check(osver:"13.0", arch:"x86_64", pkgname:"curl", pkgver:"7.19.6", pkgarch:"x86_64", pkgnum:"2_slack13.0")) flag++; if (slackware_check(osver:"13.1", pkgname:"curl", pkgver:"7.20.1", pkgarch:"i486", pkgnum:"2_slack13.1")) flag++; if (slackware_check(osver:"13.1", arch:"x86_64", pkgname:"curl", pkgver:"7.20.1", pkgarch:"x86_64", pkgnum:"2_slack13.1")) flag++; if (slackware_check(osver:"13.37", pkgname:"curl", pkgver:"7.21.4", pkgarch:"i486", pkgnum:"2_slack13.37")) flag++; if (slackware_check(osver:"13.37", arch:"x86_64", pkgname:"curl", pkgver:"7.21.4", pkgarch:"x86_64", pkgnum:"2_slack13.37")) flag++; if (slackware_check(osver:"14.0", pkgname:"curl", pkgver:"7.29.0", pkgarch:"i486", pkgnum:"3_slack14.0")) flag++; if (slackware_check(osver:"14.0", arch:"x86_64", pkgname:"curl", pkgver:"7.29.0", pkgarch:"x86_64", pkgnum:"3_slack14.0")) flag++; if (slackware_check(osver:"current", pkgname:"curl", pkgver:"7.31.0", pkgarch:"i486", pkgnum:"1")) flag++; if (slackware_check(osver:"current", arch:"x86_64", pkgname:"curl", pkgver:"7.31.0", pkgarch:"x86_64", pkgnum:"1")) flag++; if (flag) { if (report_verbosity > 0) security_warning(port:0, extra:slackware_report_get()); else security_warning(0); exit(0); } else audit(AUDIT_HOST_NOT, "affected");NASL family Mandriva Local Security Checks NASL id MANDRIVA_MDVSA-2013-180.NASL description A vulnerability has been discovered and corrected in curl : libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption. The function curl_easy_unescape() decodes URL encoded strings to raw binary data. URL encoded octets are represented with \%HH combinations where HH is a two-digit hexadecimal number. The decoded string is written to an allocated memory area that the function returns to the caller (CVE-2013-2174). The updated packages have been patched to correct this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 67010 published 2013-06-28 reporter This script is Copyright (C) 2013-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/67010 title Mandriva Linux Security Advisory : curl (MDVSA-2013:180) NASL family SuSE Local Security Checks NASL id SUSE_CURL-8614.NASL description This update of curl fixes several security issues. - libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174) last seen 2020-06-05 modified 2013-07-11 plugin id 67242 published 2013-07-11 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/67242 title SuSE 10 Security Update : curl (ZYPP Patch Number 8614) NASL family Scientific Linux Local Security Checks NASL id SL_20130625_CURL_ON_SL5_X.NASL description A heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code. (CVE-2013-2174) All running applications using libcurl must be restarted for the update to take effect. last seen 2020-03-18 modified 2013-06-26 plugin id 66982 published 2013-06-26 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66982 title Scientific Linux Security Update : curl on SL5.x, SL6.x i386/srpm/x86_64 (20130625) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2013-0983.NASL description Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. cURL provides the libcurl library and a command line tool for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. A heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code. (CVE-2013-2174) Red Hat would like to thank the cURL project for reporting this issue. Upstream acknowledges Timo Sirainen as the original reporter. Users of curl should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libcurl must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 66981 published 2013-06-26 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66981 title RHEL 5 / 6 : curl (RHSA-2013:0983) NASL family SuSE Local Security Checks NASL id SUSE_COMPAT-CURL2-8621.NASL description This update of compat-curl2 fixes a security vulnerability : - libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174) last seen 2020-06-05 modified 2013-07-10 plugin id 67222 published 2013-07-10 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/67222 title SuSE 10 Security Update : compat-curl2 (ZYPP Patch Number 8621) NASL family SuSE Local Security Checks NASL id SUSE_11_CURL-130625.NASL description This update of curl fixes a security issue in libcurl URL buffer decoding. (bnc#824517 / CVE-2013-2174) last seen 2020-06-05 modified 2013-07-18 plugin id 68948 published 2013-07-18 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/68948 title SuSE 11.3 Security Update : curl (SAT Patch Number 7932) NASL family Solaris Local Security Checks NASL id SOLARIS11_LIBCURL_20140415.NASL description The remote Solaris system is missing necessary patches to address security updates : - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. (CVE-2013-1944) - Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a last seen 2020-06-01 modified 2020-06-02 plugin id 80662 published 2015-01-19 reporter This script is Copyright (C) 2015-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/80662 title Oracle Solaris Third-Party Patch Update : libcurl (cve_2013_1944_information_disclosure) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_01CF67B3DC3B11E2A6CDC48508086173.NASL description cURL developers report : libcurl is vulnerable to a case of bad checking of the input data which may lead to heap corruption. The function curl_easy_unescape() decodes URL-encoded strings to raw binary data. URL-encoded octets are represented with %HH combinations where HH is a two-digit hexadecimal number. The decoded string is written to an allocated memory area that the function returns to the caller. The function takes a source string and a length parameter, and if the length provided is 0 the function will instead use strlen() to figure out how much data to parse. The last seen 2020-06-01 modified 2020-06-02 plugin id 66968 published 2013-06-24 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66968 title FreeBSD : cURL library -- heap corruption in curl_easy_unescape (01cf67b3-dc3b-11e2-a6cd-c48508086173) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2013-0983.NASL description Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. cURL provides the libcurl library and a command line tool for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. A heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code. (CVE-2013-2174) Red Hat would like to thank the cURL project for reporting this issue. Upstream acknowledges Timo Sirainen as the original reporter. Users of curl should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libcurl must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 66998 published 2013-06-27 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66998 title CentOS 5 / 6 : curl (CESA-2013:0983) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2013-0983.NASL description From Red Hat Security Advisory 2013:0983 : Updated curl packages that fix one security issue are now available for Red Hat Enterprise Linux 5 and 6. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. cURL provides the libcurl library and a command line tool for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. A heap-based buffer overflow flaw was found in the way libcurl unescaped URLs. A remote attacker could provide a specially crafted URL that, when processed by an application using libcurl that handles untrusted URLs, would possibly cause it to crash or, potentially, execute arbitrary code. (CVE-2013-2174) Red Hat would like to thank the cURL project for reporting this issue. Upstream acknowledges Timo Sirainen as the original reporter. Users of curl should upgrade to these updated packages, which contain a backported patch to correct this issue. All running applications using libcurl must be restarted for the update to take effect. last seen 2020-06-01 modified 2020-06-02 plugin id 68841 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/68841 title Oracle Linux 5 / 6 : curl (ELSA-2013-0983) NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-552.NASL description A vulnerability was discovered for the curl and libcurl packages in openSUSE versions 12.2 and 12.3. last seen 2020-06-05 modified 2014-06-13 plugin id 75070 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/75070 title openSUSE Security Update : curl / libcurl (openSUSE-SU-2013:1132-1) NASL family Fedora Local Security Checks NASL id FEDORA_2013-11568.NASL description CVE-2013-2174 - fix heap-based buffer overflow in curl_easy_unescape() Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-07-23 plugin id 68998 published 2013-07-23 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/68998 title Fedora 17 : curl-7.24.0-10.fc17 (2013-11568) NASL family Fedora Local Security Checks NASL id FEDORA_2013-11521.NASL description CVE-2013-2174 - fix heap-based buffer overflow in curl_easy_unescape() Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-07-12 plugin id 67312 published 2013-07-12 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/67312 title Fedora 19 : curl-7.29.0-7.fc19 (2013-11521) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2713.NASL description Timo Sirainen discovered that cURL, an URL transfer library, is prone to a heap overflow vulnerability due to bad checking of the input data in the curl_easy_unescape function. The curl command line tool is not affected by this problem as it doesn last seen 2020-03-17 modified 2013-06-25 plugin id 66974 published 2013-06-25 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66974 title Debian DSA-2713-1 : curl - heap overflow NASL family OracleVM Local Security Checks NASL id ORACLEVM_OVMSA-2016-0056.NASL description The remote OracleVM system is missing necessary patches to address critical security updates : - fix heap-based buffer overflow in curl_easy_unescape (CVE-2013-2174) - fix cookie tailmatching to prevent cross-domain leakage (CVE-2013-1944) - introduce the --delegation option of curl (#746849) - fix stack smashing in the FTP implementation (#652557) - fix proxy kerberos authentication (#657396) - update running_handles counter properly in curl_multi_remove_handle (#688871) - add a new option CURLOPT_GSSAPI_DELEGATION (#723643) - do not delegate GSSAPI credentials (CVE-2011-2192) - avoid use of uninitialized variable on failure of a LDAP request (#655073) - proxy tunnel support for LDAP requests (#655073) last seen 2020-06-01 modified 2020-06-02 plugin id 91740 published 2016-06-22 reporter This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/91740 title OracleVM 3.2 : curl (OVMSA-2016-0056) NASL family SuSE Local Security Checks NASL id SUSE_11_CURL-130618.NASL description This update of curl fixes several security issues : - libcurl URL decode buffer boundary flaw (bnc#824517 / CVE-2013-2174) last seen 2020-06-05 modified 2013-07-10 plugin id 67221 published 2013-07-10 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/67221 title SuSE 11.2 Security Update : curl (SAT Patch Number 7867) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2013-1076.NASL description An updated rhev-hypervisor6 package that fixes one security issue and various bugs is now available. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: A subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. It was discovered that the fix for the CVE-2013-1619 issue released via RHSA-2013:0636 introduced a regression in the way GnuTLS decrypted TLS/SSL encrypted records when CBC-mode cipher suites were used. A remote attacker could possibly use this flaw to crash a server or client application that uses GnuTLS. (CVE-2013-2116) This updated package provides updated components that include fixes for various security issues. These issues have no security impact on Red Hat Enterprise Virtualization Hypervisor itself, however. The security fixes included in this update address the following CVE numbers : CVE-2013-2174 (curl issue) CVE-2012-6548, CVE-2013-0914, CVE-2013-1848, CVE-2013-2128, CVE-2013-2634, CVE-2013-2635, CVE-2013-2852, CVE-2013-3222, CVE-2013-3224, CVE-2013-3225, and CVE-2013-3301 (kernel issues) CVE-2002-2443 (krb5 issue) CVE-2013-1950 (libtirpc issue) Upgrade Note: If you upgrade the Red Hat Enterprise Virtualization Hypervisor through the 3.2 Manager administration portal, the Host may appear with the status of last seen 2020-06-01 modified 2020-06-02 plugin id 78965 published 2014-11-08 reporter This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/78965 title RHEL 6 : rhev-hypervisor6 (RHSA-2013:1076) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201401-14.NASL description The remote host is affected by the vulnerability described in GLSA-201401-14 (cURL: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in cURL. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could entice a user or automated process to connect to a malicious server using cURL, possibly resulting in the remote execution of arbitrary code or a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 72053 published 2014-01-21 reporter This script is Copyright (C) 2014-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/72053 title GLSA-201401-14 : cURL: Multiple vulnerabilities NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1550.NASL description According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading data beyond the end of a heap based buffer used to store downloaded RTSP content..(CVE-2018-1000301) - It was found that the libcurl library did not check the client certificate when choosing the TLS connection to reuse. An attacker could potentially use this flaw to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.(CVE-2016-5420) - It was discovered that libcurl could incorrectly reuse NTLM-authenticated connections for subsequent unauthenticated requests to the same host. If an application using libcurl established an NTLM-authenticated connection to a server, and sent subsequent unauthenticated requests to the same server, the unauthenticated requests could be sent over the NTLM-authenticated connection, appearing as if they were sent by the NTLM authenticated user.(CVE-2015-3143) - libcurl may read outside of a heap allocated buffer when doing FTP. When libcurl connects to an FTP server and successfully logs in (anonymous or not), it asks the server for the current directory with the `PWD` command. The server then responds with a 257 response containing the path, inside double quotes. The returned path name is then kept by libcurl for subsequent uses. Due to a flaw in the string parser for this directory name, a directory name passed like this but without a closing double quote would lead to libcurl not adding a trailing NUL byte to the buffer holding the name. When libcurl would then later access the string, it could read beyond the allocated heap buffer and crash or wrongly access data beyond the buffer, thinking it was part of the path. A malicious server could abuse this fact and effectively prevent libcurl-based clients to work with it - the PWD command is always issued on new FTP connections and the mistake has a high chance of causing a segfault. The simple fact that this has issue remained undiscovered for this long could suggest that malformed PWD responses are rare in benign servers. We are not aware of any exploit of this flaw. This bug was introduced in commit 415d2e7cb7(https://github.com/curl/curl/commit/415d2e7c b7), March 2005. In libcurl version 7.56.0, the parser always zero terminates the string but also rejects it if not terminated properly with a final double quote.(CVE-2017-1000254) - It was discovered that libcurl could incorrectly reuse Negotiate authenticated HTTP connections for subsequent requests. If an application using libcurl established a Negotiate authenticated HTTP connection to a server and sent subsequent requests with different credentials, the connection could be re-used with the initial set of credentials instead of using the new ones.(CVE-2015-3148) - Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted string ending in a last seen 2020-06-01 modified 2020-06-02 plugin id 125003 published 2019-05-14 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125003 title EulerOS Virtualization 3.0.1.0 : curl (EulerOS-SA-2019-1550) NASL family Fedora Local Security Checks NASL id FEDORA_2013-11574.NASL description CVE-2013-2174 - fix heap-based buffer overflow in curl_easy_unescape() Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-07-12 plugin id 67313 published 2013-07-12 reporter This script is Copyright (C) 2013-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/67313 title Fedora 18 : curl-7.27.0-11.fc18 (2013-11574) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-1894-1.NASL description Timo Sirainen discovered that libcurl incorrectly handled memory when parsing URL encoded strings. An attacker could possibly use this issue to cause libcurl to crash, leading to a denial of service, or execute arbitrary code. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 67138 published 2013-07-03 reporter Ubuntu Security Notice (C) 2013-2019 Canonical, Inc. / NASL script (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67138 title Ubuntu 10.04 LTS / 12.04 LTS / 12.10 / 13.04 : curl vulnerability (USN-1894-1)
Redhat
| advisories |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| rpms |
|
Seebug
| bulletinFamily | exploit |
| description | BUGTRAQ ID: 60737 CVE(CAN) ID: CVE-2013-2174 cURL是命令行传输文件工具，支持FTP、FTPS、HTTP、HTTPS、GOPHER、TELNET、DICT、FILE和LDAP。 cURL 7.7 - 7.30.0版本内的函数"curl_easy_unescape()"(lib/escape.c)将URL编码的字符串解码为原始二进制数据时出现边界错误，此漏洞可被利用造成堆缓冲区溢出，导致任意代码执行。 0 cURL 7.x 临时解决方法： 建议您采取以下措施以降低威胁： * 升级到curl/libcurl 7.31.0 * 应用补丁，重建libcurl http://curl.haxx.se/libcurl-unescape.patch * 复核curl_easy_unescape()，或不使用此函数。 厂商补丁： cURL ---- cURL已经为此发布了一个安全公告（adv_20130622）以及相应补丁: adv_20130622：libcurl URL decode buffer boundary flaw 链接：http://curl.haxx.se/docs/adv_20130622.html 补丁下载：http://curl.haxx.se/libcurl-unescape.patch |
| id | SSV:60852 |
| last seen | 2017-11-19 |
| modified | 2013-06-26 |
| published | 2013-06-26 |
| reporter | Root |
| title | cURL/libcURL 'curl_easy_unescape()'堆内存破坏漏洞 |
References
- http://curl.haxx.se/docs/adv_20130622.html
- http://lists.opensuse.org/opensuse-updates/2013-07/msg00013.html
- http://rhn.redhat.com/errata/RHSA-2013-0983.html
- http://www.debian.org/security/2013/dsa-2713
- http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.securityfocus.com/bid/60737
- http://www.ubuntu.com/usn/USN-1894-1
- https://github.com/bagder/curl/commit/192c4f788d48f82c03e9cef40013f34370e90737