cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

The remote host is affected by the vulnerability described in GLSA-201509-02 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly obtain sensitive information, or cause       a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Curl was updated to fix two security issues and enable metalink support

The following vulnerabilities were fixed :

  - CVE-2015-3236: libcurl could have wrongly send HTTP     credentials when re-using connections (boo#934501)

  - CVE-2015-3237: libcurl could have been tricked by a     malicious SMB server to send off data it did not intend     to (boo#934502)

The following feature was enabled :

  - boo#851126: enable metalink support.

- implement public key pinning for NSS backend (#1195771)

    - fix lingering HTTP credentials in connection re-use       (CVE-2015-3236)

    - prevent SMB from sending off unrelated memory contents       (CVE-2015-3237)

    - curl-config --libs now works on x86_64 without       libcurl-devel.x86_64 (#1228363)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

As discussed upstream, libcurl can wrongly send HTTP credentials when re-using connections. (CVE-2015-3236)

Also discussed upstream, libcurl can get tricked by a malicious SMB server to send off data it did not intend to. (CVE-2015-3237)

cURL reports :

libcurl can wrongly send HTTP credentials when re-using connections.

libcurl allows applications to set credentials for the upcoming transfer with HTTP Basic authentication, like with CURLOPT_USERPWD for example. Name and password. Just like all other libcurl options the credentials are sticky and are kept associated with the 'handle' until something is made to change the situation.

Further, libcurl offers a curl_easy_reset() function that resets a handle back to its pristine state in terms of all settable options. A reset is of course also supposed to clear the credentials. A reset is typically used to clear up the handle and prepare it for a new, possibly unrelated, transfer.

Within such a handle, libcurl can also store a set of previous connections in case a second transfer is requested to a host name for which an existing connection is already kept alive.

With this flaw present, using the handle even after a reset would make libcurl accidentally use those credentials in a subsequent request if done to the same host name and connection as was previously accessed.

An example case would be first requesting a password protected resource from one section of a website, and then do a second request of a public resource from a completely different part of the site without authentication. This flaw would then inadvertently leak the credentials in the second request.

libcurl can get tricked by a malicious SMB server to send off data it did not intend to.

In libcurl's state machine function handling the SMB protocol (smb_request_state()), two length and offset values are extracted from data that has arrived over the network, and those values are subsequently used to figure out what data range to send back.

The values are used and trusted without boundary checks and are just assumed to be valid. This allows carefully handcrafted packages to trick libcurl into responding and sending off data that was not intended. Or just crash if the values cause libcurl to access invalid memory.

ID	Name	Product	Family	Severity
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	critical
86662	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : curl (SSA:2015-302-01)	Nessus	Slackware Local Security Checks	high
86133	GLSA-201509-02 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
84387	openSUSE Security Update : curl (openSUSE-2015-446)	Nessus	SuSE Local Security Checks	medium
84376	Fedora 22 : curl-7.40.0-5.fc22 (2015-10155)	Nessus	Fedora Local Security Checks	medium
84293	Amazon Linux AMI : curl (ALAS-2015-551)	Nessus	Amazon Linux Local Security Checks	medium
84254	FreeBSD : cURL -- Multiple Vulnerability (2438d4af-1538-11e5-a106-3c970e169bc2)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-3236

high

Tenable Plugins

critical

high

high

medium

medium

medium

medium