curl and libcurl 7.27.0 through 7.35.0, when running on Windows and using the SChannel/Winssl TLS backend, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when accessing a URL that uses a numerical IP address, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - cURL and libcurl 7.18.0 through 7.32.0, when built with     OpenSSL, disables the certificate CN and SAN name field     verification (CURLOPT_SSL_VERIFYHOST) when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid     certificate.i1/4^CVE-2013-4545i1/4%0

  - The GnuTLS backend in libcurl 7.21.4 through 7.33.0,     when disabling digital signature verification     (CURLOPT_SSL_VERIFYPEER), also disables the     CURLOPT_SSL_VERIFYHOST check for CN or SAN host name     fields, which makes it easier for remote attackers to     spoof servers and conduct man-in-the-middle (MITM)     attacks.i1/4^CVE-2013-6422i1/4%0

  - cURL and libcurl 7.1 before 7.36.0, when using the     OpenSSL, axtls, qsossl or gskit libraries for TLS,     recognize a wildcard IP address in the subject's Common     Name (CN) field of an X.509 certificate, which might     allow man-in-the-middle attackers to spoof arbitrary     SSL servers via a crafted certificate issued by a     legitimate Certification Authority.i1/4^CVE-2014-0139i1/4%0

  - curl and libcurl 7.27.0 through 7.35.0, when running on     Windows and using the SChannel/Winssl TLS backend, does     not verify that the server hostname matches a domain     name in the subject's Common Name (CN) or     subjectAltName field of the X.509 certificate when     accessing a URL that uses a numerical IP address, which     allows man-in-the-middle attackers to spoof servers via     an arbitrary valid certificate.i1/4^CVE-2014-2522i1/4%0

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.i1/4^CVE-2017-7407i1/4%0

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external     entities.i1/4^CVE-2018-1000007i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is prior to 7.2.6. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - HP SMH (XSRF)
    - libcurl
    - OpenSSL

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

ID	Name	Product	Family	Severity
123858	EulerOS Virtualization 2.5.3 : curl (EulerOS-SA-2019-1172)	Nessus	Huawei Local Security Checks	critical
90251	HP System Management Homepage < 7.2.6 Multiple Vulnerabilities (FREAK)	Nessus	Web Servers	high
73247	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : curl (SSA:2014-086-01)	Nessus	Slackware Local Security Checks	medium

Detections

Analytics

CVE-2014-2522

medium

Tenable Plugins

critical

high

medium