The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The GnuTLS backend in libcurl 7.21.4 through 7.33.0,     when disabling digital signature verification     (CURLOPT_SSL_VERIFYPEER), also disables the     CURLOPT_SSL_VERIFYHOST check for CN or SAN host name     fields, which makes it easier for remote attackers to     spoof servers and conduct man-in-the-middle (MITM)     attacks.(CVE-2013-6422)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap use-after-free flaw was found in curl versions     from 7.59.0 through 7.61.1 in the code related to     closing an easy handle. When closing and cleaning up an     'easy' handle in the `Curl_close()` function, the     library code first frees a struct (without nulling the     pointer) and might then subsequently erroneously write     to a struct field within that already freed     struct.(CVE-2018-16840)

  - cURL and libcurl 7.18.0 through 7.32.0, when built with     OpenSSL, disables the certificate CN and SAN name field     verification (CURLOPT_SSL_VERIFYHOST) when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid     certificate.(CVE-2013-4545)

  - The GnuTLS backend in libcurl 7.21.4 through 7.33.0,     when disabling digital signature verification     (CURLOPT_SSL_VERIFYPEER), also disables the     CURLOPT_SSL_VERIFYHOST check for CN or SAN host name     fields, which makes it easier for remote attackers to     spoof servers and conduct man-in-the-middle (MITM)     attacks.(CVE-2013-6422)

  - cURL and libcurl 7.1 before 7.36.0, when using the     OpenSSL, axtls, qsossl or gskit libraries for TLS,     recognize a wildcard IP address in the subject's Common     Name (CN) field of an X.509 certificate, which might     allow man-in-the-middle attackers to spoof arbitrary     SSL servers via a crafted certificate issued by a     legitimate Certification Authority.(CVE-2014-0139)

  - The (1) mbed_connect_step1 function in     lib/vtls/mbedtls.c and (2) polarssl_connect_step1     function in lib/vtls/polarssl.c in cURL and libcurl     before 7.49.0, when using SSLv3 or making a TLS     connection to a URL that uses a numerical IP address,     allow remote attackers to spoof servers via an     arbitrary valid certificate.(CVE-2016-3739)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - cURL and libcurl 7.18.0 through 7.32.0, when built with     OpenSSL, disables the certificate CN and SAN name field     verification (CURLOPT_SSL_VERIFYHOST) when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid     certificate.i1/4^CVE-2013-4545i1/4%0

  - The GnuTLS backend in libcurl 7.21.4 through 7.33.0,     when disabling digital signature verification     (CURLOPT_SSL_VERIFYPEER), also disables the     CURLOPT_SSL_VERIFYHOST check for CN or SAN host name     fields, which makes it easier for remote attackers to     spoof servers and conduct man-in-the-middle (MITM)     attacks.i1/4^CVE-2013-6422i1/4%0

  - cURL and libcurl 7.1 before 7.36.0, when using the     OpenSSL, axtls, qsossl or gskit libraries for TLS,     recognize a wildcard IP address in the subject's Common     Name (CN) field of an X.509 certificate, which might     allow man-in-the-middle attackers to spoof arbitrary     SSL servers via a crafted certificate issued by a     legitimate Certification Authority.i1/4^CVE-2014-0139i1/4%0

  - curl and libcurl 7.27.0 through 7.35.0, when running on     Windows and using the SChannel/Winssl TLS backend, does     not verify that the server hostname matches a domain     name in the subject's Common Name (CN) or     subjectAltName field of the X.509 certificate when     accessing a URL that uses a numerical IP address, which     allows man-in-the-middle attackers to spoof servers via     an arbitrary valid certificate.i1/4^CVE-2014-2522i1/4%0

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.i1/4^CVE-2017-7407i1/4%0

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external     entities.i1/4^CVE-2018-1000007i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is affected by the following vulnerabilities :

  - A flaw exists within the included cURL that disables the     'CURLOPT_SSLVERIFYHOST' check when the setting on     'CURLOPT_SSL_VERIFYPEER' is disabled. This can allow a     remote attacker to disable SSL certificate host name     checks. (CVE-2013-4545)

  - A flaw exists in the included PHP 'openssl_x509_parse'     function due to user input not being properly sanitized.
    Using a specially crafted certificate, a remote attacker     can exploit this to cause a denial of service or execute     arbitrary code. (CVE-2013-6420)

  - A flaw exists within the included cURL where the     verification check for the CN and SAN name fields is     skipped due to the digital signature verification being     disabled. A remote attacker can exploit this to spoof     servers or conduct a man-in-the-middle attack.
    (CVE-2013-6422)

  - A flaw exists in the scan function within the included     PHP 'ext/date/lib/parse_iso_intervals.c' script where     user input is not properly sanitized. This can allow a     remote attacker to cause a denial of service using a     heap-based buffer overflow. (CVE-2013-6712)

  - An unspecified cross-site scripting flaw exists which     can allow a remote attacker, using a specially crafted     request, to execute arbitrary code within the     browser / server trust relationship. (CVE-2014-2640)

  - An unspecified cross-site request forgery vulnerability     exists. (CVE-2014-2641)

  - An unspecified vulnerability exists that can allow     a remote attacker to conduct clickjacking attacks.
    (CVE-2014-2642)

The remote host is affected by the vulnerability described in GLSA-201401-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated process to connect to       a malicious server using cURL, possibly resulting in the remote execution       of arbitrary code or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Marc Deslauriers discovered that curl, a file retrieval tool, would mistakenly skip verifying the CN and SAN name fields when digital signature verification was disabled in the libcurl GnuTLS backend.

The default configuration for the curl package is not affected by this issue since the digital signature verification is enabled by default.

The oldstable distribution (squeeze) is not affected by this problem.

Marc Deslauriers discovered that libcurl incorrectly verified CN and SAN name fields when digital signature verification was disabled in the GnuTLS backend. When libcurl is being used in this uncommon way by specific applications, an attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

cURL project reports :

libcurl is vulnerable to a case of missing out the checking of the certificate CN or SAN name field when the digital signature verification is turned off.

libcurl offers two separate and independent options for verifying a server's TLS certificate. CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST. The first one tells libcurl to verify the trust chain using a CA cert bundle, while the second tells libcurl to make sure that the name fields in the server certificate meets the criteria. Both options are enabled by default.

This flaw had the effect that when an application disabled CURLOPT_SSL_VERIFYPEER, libcurl mistakenly also skipped the CURLOPT_SSL_VERIFYHOST check. Applications can disable CURLOPT_SSL_VERIFYPEER and still achieve security by doing the check on its own using other means.

The curl command line tool is not affected by this problem as it either enables both options or disables both at the same time.

ID	Name	Product	Family	Severity
149176	EulerOS 2.0 SP3 : curl (EulerOS-SA-2021-1774)	Nessus	Huawei Local Security Checks	medium
137468	EulerOS 2.0 SP2 : curl (EulerOS-SA-2020-1626)	Nessus	Huawei Local Security Checks	critical
123858	EulerOS Virtualization 2.5.3 : curl (EulerOS-SA-2019-1172)	Nessus	Huawei Local Security Checks	critical
78090	HP System Management Homepage < 7.4 Multiple Vulnerabilities	Nessus	Web Servers	high
72053	GLSA-201401-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
71541	Debian DSA-2824-1 : curl - unchecked tls/ssl certificate host name	Nessus	Debian Local Security Checks	medium
71531	Ubuntu 12.04 LTS / 12.10 / 13.04 / 13.10 : curl vulnerability (USN-2058-1)	Nessus	Ubuntu Local Security Checks	medium
71530	FreeBSD : cURL library -- cert name check ignore with GnuTLS (4e1f4abc-6837-11e3-9cda-3c970e169bc2)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2013-6422

critical

Tenable Plugins

medium

critical

critical

high

high

medium

medium

medium