The fix_hostname function in cURL and libcurl 7.37.0 through 7.41.0 does not properly calculate an index, which allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) or possibly have other unspecified impact via a zero-length host name, as demonstrated by "http://:80" and ":80."

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

According to its self-reported version, the MySQL Enterprise Monitor application running on the remote host is 2.3.x prior to 2.3.21 or 3.0.x prior to 3.0.23. It is, therefore, potentially affected by multiple vulnerabilities :

  - An invalid read error exists in the ASN1_TYPE_cmp()     function due to improperly performed boolean-type     comparisons. A remote attacker can exploit this, via a     crafted X.509 certificate to an endpoint that uses the     certificate-verification feature, to cause an invalid     read operation, resulting in a denial of service.
    (CVE-2015-0286)

  - A denial of service vulnerability exists in the libcurl     library due to a failure by the fix_hostname() function     to properly calculate an index. An unauthenticated,     remote attacker can exploit this, via a zero-length host     name, to cause a denial of service or possibly have     other unspecified impact. (CVE-2015-3144)

The remote host is running a version of Mac OS X 10.10.x that is prior to version 10.10.5. The installed version is affected by multiple vulnerabilities in the following components :

 - apache (CVE-2014-3581, CVE-2014-3583, CVE-2014-8109, CVE-2015-0228, CVE-2015-0253, CVE-2015-3183, CVE-2015-3185)
 - apache_mod_php (CVE-2015-2783, CVE-2015-2787, CVE-2015-3307, CVE-2015-3329, CVE-2015-3330, CVE-2015-4021, CVE-2015-4022, CVE-2015-4024, CVE-2015-4025, CVE-2015-4026, CVE-2015-4147, CVE-2015-4148)
 - Apple ID OD Plug-in (CVE-2015-3799)
 - AppleGraphicsControl (CVE-2015-5768)
 - Bluetooth (CVE-2015-3777, CVE-2015-3779, CVE-2015-3780, CVE-2015-3786, CVE-2015-3787)
 - bootp (CVE-2015-3778)
 - CloudKit (CVE-2015-3782)
 - CoreMedia Playback (CVE-2015-5777, CVE-2015-5778)
 - CoreText (CVE-2015-5761, CVE-2015-5755)
 - curl (CVE-2014-3613, CVE-2014-3620, CVE-2014-3707, CVE-2014-8150, CVE-2014-8151, CVE-2015-3143, CVE-2015-3144, CVE-2015-3145, CVE-2015-3148, CVE-2015-3153)
 - Data Detectors Engine (CVE-2015-5750)
 - Date & Time pref pane (CVE-2015-3757)
 - Dictionary Application (CVE-2015-3774)
 - DiskImages (CVE-2015-3800)
 - dyld (CVE-2015-3760)
 - FontParser (CVE-2015-3804, CVE-2015-5775, CVE-2015-5756)
 - groff (CVE-2009-5044, CVE-2009-5078)
 - ImageIO (CVE-2015-5758, CVE-2015-5781, CVE-2015-5782)
 - Install Framework Legacy (CVE-2015-5784, CVE-2015-5754)
 - IOFireWireFamily (CVE-2015-3769, CVE-2015-3771, CVE-2015-3772)
 - IOGraphics (CVE-2015-3770, CVE-2015-5783)
 - IOHIDFamily (CVE-2015-5774)
 - Kernel (CVE-2015-3766, CVE-2015-3768, CVE-2015-5747, CVE-2015-5748, CVE-2015-3806, CVE-2015-3803, CVE-2015-3802, CVE-2015-3805, CVE-2015-3776, CVE-2015-3761)
 - Libc (CVE-2015-3796, CVE-2015-3797, CVE-2015-3798)
 - Libinfo (CVE-2015-5776)
 - libpthread (CVE-2015-5757)
 - libxml2 (CVE-2014-0191, CVE-2014-3660, CVE-2015-3807)
 - libxpc (CVE-2015-3795)
 - mail_cmds (CVE-2014-7844)
 - Notification Center OSX (CVE-2015-3764)
 - ntfs (CVE-2015-5763)
 - OpenSSH (CVE-2015-5600)
 - OpenSSL (CVE-2015-1788, CVE-2015-1789, CVE-2015-1790, CVE-2015-1791, CVE-2015-1792)
 - perl (CVE-2013-7422)
 - PostgreSQL (CVE-2014-0067, CVE-2014-8161, CVE-2015-0241, CVE-2015-0242, CVE-2015-0243, CVE-2015-0244)
 - python (CVE-2013-7040, CVE-2013-7338, CVE-2014-1912, CVE-2014-7185, CVE-2014-9365)
 - QL Office (CVE-2015-5773, CVE-2015-3784)
 - Quartz Composer Framework (CVE-2015-5771)
 - Quick Look (CVE-2015-3781)
 - QuickTime 7 (CVE-2015-3779, CVE-2015-5753, CVE-2015-5779, CVE-2015-3765, CVE-2015-3788, CVE-2015-3789, CVE-2015-3790, CVE-2015-3791, CVE-2015-3792, CVE-2015-5751)
 - SceneKit (CVE-2015-5772, CVE-2015-3783)
 - Security (CVE-2015-3775)
 - SMBClient (CVE-2015-3773)
 - Speech UI (CVE-2015-3794)
 - sudo (CVE-2013-1775, CVE-2013-1776, CVE-2013-2776, CVE-2013-2777, CVE-2014-0106, CVE-2014-9680)
 - tcpdump (CVE-2014-8767, CVE-2014-8769, CVE-2014-9140)
 - Text Formats (CVE-2015-3762)
 - udf (CVE-2015-3767)

 Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is affected by the vulnerability described in GLSA-201509-02 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly obtain sensitive information, or cause       a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

cURL and libcurl before 7.42.0 are unpatched for the following vulnerabilities: 

 - A flaw may be triggered when an application reuses an authenticated connection and performs a subsequent unauthenticated NTLM HTTP request allowing an attacker to bypass authentication mechanisms. (CVE-2015-3143) 
 - An off-by-one flaw in the 'fix_hostname()' function that is triggered when handling a zero-length hostname allowing an attacker to cause a program linked against the library to crash. (CVE-2015-3144) 
 -  A flaw in the 'sanitize_cookie_path()' function is triggered when handling a cookie path element that consists of a single double-quote allowing an attacker to destroy heap memory and potentially cause a program linked against the library to crash. (CVE-2015-3145) 
 - A flaw may be triggered when a request is Negotiate authenticated, which can cause the program to treat the entire connection as authenticated rather than just that specific request allowing an attacker to bypass authentication mechanisms for subsequent requests. (CVE-2015-3148)

The remote host is running a version of Mac OS X 10.10.x that is prior to 10.10.5. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache
  - apache_mod_php
  - Apple ID OD Plug-in
  - AppleGraphicsControl
  - Bluetooth
  - bootp
  - CloudKit
  - CoreMedia Playback
  - CoreText
  - curl
  - Data Detectors Engine
  - Date & Time pref pane
  - Dictionary Application
  - DiskImages
  - dyld
  - FontParser
  - groff
  - ImageIO
  - Install Framework Legacy
  - IOFireWireFamily
  - IOGraphics
  - IOHIDFamily
  - Kernel
  - Libc
  - Libinfo
  - libpthread
  - libxml2
  - libxpc
  - mail_cmds
  - Notification Center OSX
  - ntfs
  - OpenSSH
  - OpenSSL
  - perl
  - PostgreSQL
  - python
  - QL Office
  - Quartz Composer Framework
  - Quick Look
  - QuickTime 7
  - SceneKit
  - Security
  - SMBClient
  - Speech UI
  - sudo
  - tcpdump
  - Text Formats
  - udf 

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

curl was updated to fix five security issues.

The following vulnerabilities were fixed :

  - CVE-2015-3143: curl could re-use NTML authenticateds     connections

  - CVE-2015-3144: curl could access memory out of bounds     with zero length host names

  - CVE-2015-3145: curl cookie parser could access memory     out of boundary

  - CVE-2015-3148: curl could treat Negotiate as not     connection-oriented

  - CVE-2015-3153: curl could have sent sensitive HTTP     headers also to proxies

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to 7.42.0 which fixes various CVE's

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- require credentials to match for NTLM re-use     (CVE-2015-3143)

    - fix invalid write with a zero-length host name in URL       (CVE-2015-3144)

    - fix invalid write in cookie path sanitization code       (CVE-2015-3145)

    - close Negotiate connections when done (CVE-2015-3148)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2591-1 advisory.

    Paras Sethia discovered that curl could incorrectly re-use NTLM HTTP credentials when subsequently     connecting to the same host over HTTP. (CVE-2015-3143)

    Hanno Bck discovered that curl incorrectly handled zero-length host names. If a user or automated system     were tricked into using a specially crafted host name, an attacker could possibly use this issue to cause     curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only     affected Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3144)

    Hanno Bck discovered that curl incorrectly handled cookie path elements. If a user or automated system     were tricked into parsing a specially crafted cookie, an attacker could possibly use this issue to cause     curl to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only     affected Ubuntu 14.04 LTS, Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3145)

    Isaac Boukris discovered that when using Negotiate authenticated connections, curl could incorrectly     authenticate the entire connection and not just specific HTTP requests. (CVE-2015-3148)

    Yehezkel Horowitz and Oren Souroujon discovered that curl sent HTTP headers both to servers and proxies by     default, contrary to expectations. This issue only affected Ubuntu 14.10 and Ubuntu 15.04. (CVE-2015-3153)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

curl was updated to fix four security issues.

The following vulnerabilities were fixed :

  - CVE-2015-3143: curl could re-use NTML authenticateds     connections

  - CVE-2015-3144: curl could access memory out of bounds     with zero length host names

  - CVE-2015-3145: curl cookie parser could access memory     out of boundary

  - CVE-2015-3148: curl could treat Negotiate as not     connection-oriented

It was discovered that libcurl could incorrectly reuse NTLM-authenticated connections for subsequent unauthenticated requests to the same host. If an application using libcurl established an NTLM-authenticated connection to a server, and sent subsequent unauthenticed requests to the same server, the unauthenticated requests could be sent over the NTLM-authenticated connection, appearing as if they were sent by the NTLM authenticated user.
(CVE-2015-3143)

It was discovered that libcurl could incorrectly reuse Negotiate authenticated HTTP connections for subsequent requests. If an application using libcurl established a Negotiate authenticated HTTP connection to a server and sent subsequent requests with different credentials, the connection could be re-used with the initial set of credentials instead of using the new ones. (CVE-2015-3148)

It was discovered that libcurl did not properly process cookies with a specially crafted 'path' element. If an application using libcurl connected to a malicious HTTP server sending specially crafted 'Set-Cookies' headers, this could lead to an out-of-bounds read, and possibly cause that application to crash. (CVE-2015-3145)

It was discovered that libcurl did not properly process zero-length host names. If an attacker could trick an application using libcurl into processing zero-length host names, this could lead to an out-of-bounds read, and possibly cause that application to crash.
(CVE-2015-3144)

Several vulnerabilities were discovered in cURL, an URL transfer library :

  - CVE-2015-3143     NTLM-authenticated connections could be wrongly reused     for requests without any credentials set, leading to     HTTP requests being sent over the connection     authenticated as a different user. This is similar to     the issue fixed in DSA-2849-1.

  - CVE-2015-3144     When parsing URLs with a zero-length hostname (such as     'http://:80'), libcurl would try to read from an invalid     memory address. This could allow remote attackers to     cause a denial of service (crash). This issue only     affects the upcoming stable (jessie) and unstable (sid)     distributions.

  - CVE-2015-3145     When parsing HTTP cookies, if the parsed cookie's 'path'     element consists of a single double-quote, libcurl would     try to write to an invalid heap memory address. This     could allow remote attackers to cause a denial of     service (crash). This issue only affects the upcoming     stable (jessie) and unstable (sid) distributions.

  - CVE-2015-3148     When doing HTTP requests using the Negotiate     authentication method along with NTLM, the connection     used would not be marked as authenticated, making it     possible to reuse it and send requests for one user over     the connection authenticated as a different user.

ID	Name	Product	Family	Severity
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	critical
86662	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : curl (SSA:2015-302-01)	Nessus	Slackware Local Security Checks	high
86548	MySQL Enterprise Monitor 2.3.x < 2.3.21 / 3.0.x < 3.0.23 Multiple Vulnerabilities	Nessus	CGI abuses	high
8981	Mac OS X < 10.10.5 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	high
86133	GLSA-201509-02 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
8863	cURL / libcURL 7.x < 7.42.0 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
85408	Mac OS X 10.10.x < 10.10.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
83988	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2015:0990-1)	Nessus	SuSE Local Security Checks	high
83237	Fedora 21 : mingw-curl-7.42.0-1.fc21 (2015-6853)	Nessus	Fedora Local Security Checks	high
83212	Fedora 22 : mingw-curl-7.42.0-1.fc22 (2015-6864)	Nessus	Fedora Local Security Checks	high
83208	Fedora 21 : curl-7.37.0-14.fc21 (2015-6728)	Nessus	Fedora Local Security Checks	high
83182	Ubuntu 14.04 LTS : curl vulnerabilities (USN-2591-1)	Nessus	Ubuntu Local Security Checks	critical
83159	openSUSE Security Update : curl (openSUSE-2015-336)	Nessus	SuSE Local Security Checks	high
83078	Fedora 22 : curl-7.40.0-3.fc22 (2015-6695)	Nessus	Fedora Local Security Checks	high
83057	Amazon Linux AMI : curl (ALAS-2015-514)	Nessus	Amazon Linux Local Security Checks	high
83003	Debian DSA-3232-1 : curl - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-3144

high

Tenable Plugins

critical

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high