curl supports "globbing" of URLs, in which a user can pass a numerical range to have the tool iterate over those numbers to do a sequence of transfers. In the globbing function that parses the numerical range, there was an omission that made curl read a byte beyond the end of the URL if given a carefully crafted, or just wrongly written, URL. The URL is stored in a heap based buffer, so it could then be made to wrongly read something else instead of crashing. An example of a URL that triggers the flaw would be `http://ur%20[0-60000000000000000000`.

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3558 advisory.

  - curl: TLS session resumption client cert bypass (CVE-2016-5419)

  - curl: Re-using connection with wrong client cert (CVE-2016-5420)

  - curl: Use of connection struct after free (CVE-2016-5421)

  - curl: Incorrect reuse of client certificates (CVE-2016-7141)

  - curl: escape and unescape integer overflows (CVE-2016-7167)

  - curl: Cookie injection for other servers (CVE-2016-8615)

  - curl: Case insensitive password comparison (CVE-2016-8616)

  - curl: Out-of-bounds write via unchecked multiplication (CVE-2016-8617)

  - curl: Double-free in curl_maprintf (CVE-2016-8618)

  - curl: Double-free in krb5 code (CVE-2016-8619)

  - curl: Glob parser write/read out of bounds (CVE-2016-8620)

  - curl: curl_getdate out-of-bounds read (CVE-2016-8621)

  - curl: URL unescape heap overflow via integer truncation (CVE-2016-8622)

  - curl: Use-after-free via shared cookies (CVE-2016-8623)

  - curl: Invalid URL parsing with '#' (CVE-2016-8624)

  - curl: IDNA 2003 makes curl use wrong host (CVE-2016-8625)

  - curl: printf floating point buffer overflow (CVE-2016-9586)

  - curl: --write-out out of bounds read (CVE-2017-7407)

  - curl: NTLM buffer overflow via integer overflow (CVE-2017-8816)

  - curl: FTP wildcard out of bounds read (CVE-2017-8817)

  - httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values (CVE-2017-15710)

  - httpd: <FilesMatch> bypass with a trailing newline in the file name (CVE-2017-15715)

  - curl: TFTP sends more than buffer size (CVE-2017-1000100)

  - curl: URL globbing out of bounds read (CVE-2017-1000101)

  - curl: FTP PWD response parser out of bounds read (CVE-2017-1000254)

  - curl: IMAP FETCH response out of bounds read (CVE-2017-1000257)

  - httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI     applications (CVE-2018-1283)

  - httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)

  - httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)

  - httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

  - httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)

  - httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)

  - curl: NTLM password overflow via integer overflow (CVE-2018-14618)

  - curl: HTTP authentication leak in redirects (CVE-2018-1000007)

  - curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)

  - curl: LDAP NULL pointer dereference (CVE-2018-1000121)

  - curl: RTSP RTP buffer over-read (CVE-2018-1000122)

  - curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service     (CVE-2018-1000301)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X that is 10.13.x prior to 10.13.1. It is, therefore, affected by multiple vulnerabilities in the following components :

 - APFS
 - curl
 - Dictionary Widget
 - Kernel
 - StreamingZip
 - tcpdump
 - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

An update of the curl package has been released.

The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components :

  - 802.1X
  - apache
  - AppleScript
  - ATS
  - Audio
  - CFString
  - CoreText
  - curl
  - Dictionary Widget
  - file
  - Fonts
  - fsck_msdos
  - HFS
  - Heimdal
  - HelpViewer
  - ImageIO
  - Kernel
  - libarchive
  - Open Scripting Architecture
  - PCRE
  - Postfix
  - Quick Look
  - QuickTime
  - Remote Management
  - Sandbox
  - StreamingZip
  - tcpdump
  - Wi-Fi

The remote host is running a version of Mac OS X that is 10.13.x prior to 10.13.1. It is, therefore, affected by multiple vulnerabilities in the following components :

  - APFS
  - curl
  - Dictionary Widget
  - Kernel
  - StreamingZip
  - tcpdump
  - Wi-Fi

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3441-1 advisory.

    Daniel Stenberg discovered that curl incorrectly handled large floating point output. A remote attacker     could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-9586)

    Even Rouault discovered that curl incorrectly handled large file names when doing TFTP transfers. A remote     attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain     sensitive memory contents. (CVE-2017-1000100)

    Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handled numerical range globbing. A     remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly     obtain sensitive memory contents. (CVE-2017-1000101)

    Max Dymond discovered that curl incorrectly handled FTP PWD responses. A remote attacker could use this     issue to cause curl to crash, resulting in a denial of service. (CVE-2017-1000254)

    Brian Carpenter discovered that curl incorrectly handled the --write-out command line option. A local     attacker could possibly use this issue to obtain sensitive memory contents. (CVE-2017-7407)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2017-1000100     Even Rouault reported that cURL does not properly handle     long file names when doing an TFTP upload. A malicious     HTTP(S) server can take advantage of this flaw by     redirecting a client using the cURL library to a crafted     TFTP URL and trick it to send private memory contents to     a remote server over UDP.

  - CVE-2017-1000101     Brian Carpenter and Yongji Ouyang reported that cURL     contains a flaw in the globbing function that parses the     numerical range, leading to an out-of-bounds read when     parsing a specially crafted URL.

  - CVE-2017-1000254     Max Dymond reported that cURL contains an out-of-bounds     read flaw in the FTP PWD response parser. A malicious     server can take advantage of this flaw to effectively     prevent a client using the cURL library to work with it,     causing a denial of service.

The remote host is affected by the vulnerability described in GLSA-201709-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition, obtain       sensitive information, or bypass intended restrictions for TLS sessions.
  Workaround :

    There is no known workaround at this time.

FILE buffer read out of bounds (CVE-2017-1000099)

TFTP sends more than buffer size (CVE-2017-1000100)

URL globbing out of bounds read (CVE-2017-1000101)

This update for curl fixes the following issues :

  - CVE-2017-1000100: TFP sends more than buffer size and it     could lead to a denial of service (bsc#1051644)

  - CVE-2017-1000101: URL globbing out of bounds read could     lead to a denial of service (bsc#1051643)

This update was imported from the SUSE:SLE-12:Update update project.

This update for curl fixes the following issues :

  - CVE-2017-1000100: TFP sends more than buffer size and it     could lead to a denial of service (bsc#1051644)

  - CVE-2017-1000101: URL globbing out of bounds read could     lead to a denial of service (bsc#1051643)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes for CVE-2017-1000100 and CVE-2017-1000101

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, 14.2, and -current to fix security issues.

The cURL project reports :

- FILE buffer read out of bounds

- TFTP sends more than buffer size

- URL globbing out of bounds read

ID	Name	Product	Family	Severity
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	critical
194113	RHEL 6 / 7 : httpd24 (RHSA-2018:3558)	Nessus	Red Hat Local Security Checks	critical
700512	macOS 10.13.x < 10.13.1 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
121761	Photon OS 2.0: Curl PHSA-2017-0045	Nessus	PhotonOS Local Security Checks	medium
104379	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2017-001 and 2017-004)	Nessus	MacOS X Local Security Checks	critical
104378	macOS 10.13.x < 10.13.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
103773	Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerabilities (USN-3441-1)	Nessus	Ubuntu Local Security Checks	high
103715	Debian DSA-3992-1 : curl - security update	Nessus	Debian Local Security Checks	high
103282	GLSA-201709-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
102877	Amazon Linux AMI : curl (ALAS-2017-889)	Nessus	Amazon Linux Local Security Checks	medium
102566	openSUSE Security Update : curl (openSUSE-2017-951)	Nessus	SuSE Local Security Checks	medium
102540	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:2174-1)	Nessus	SuSE Local Security Checks	medium
102463	Fedora 25 : curl (2017-f2df9d7772)	Nessus	Fedora Local Security Checks	medium
102462	Fedora 26 : curl (2017-f1ffd18079)	Nessus	Fedora Local Security Checks	medium
102365	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 14.2 / current : curl (SSA:2017-221-01)	Nessus	Slackware Local Security Checks	medium
102330	FreeBSD : cURL -- multiple vulnerabilities (69cfa386-7cd0-11e7-867f-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2017-1000101

medium

Tenable Plugins

critical

critical

critical

medium

critical

high

high

high

high

medium

medium

medium

medium

medium

medium

medium