curl, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 curl only.

cURL, as shipped in Red Hat Enterprise Linux 6 before version 7.19.7-53, did not correctly backport the fix for CVE-2015-3148 because it did not reflect the fact that the HAVE_GSSAPI define was meanwhile substituted by USE_HTTP_NEGOTIATE. This issue was introduced in RHEL 6.7 and affects RHEL 6 cURLonly. (CVE-2017-2628)

Impact

An application using libcurl with HTTP Negotiate authentication can incorrectly re-use credentials for subsequent requests to the same server.

The remote NewStart CGSL host, running version MAIN 4.05, has curl packages installed that are affected by a vulnerability:

  - It was found that the fix for CVE-2015-3148 in curl was     incomplete. An application using libcurl with HTTP     Negotiate authentication could incorrectly re-use     credentials for subsequent requests to the same server.
    (CVE-2017-2628)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for curl is now available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.

Security Fix(es) :

* It was found that the fix for CVE-2015-3148 in curl was incomplete.
An application using libcurl with HTTP Negotiate authentication could incorrectly re-use credentials for subsequent requests to the same server. (CVE-2017-2628)

This issue was discovered by Paulo Andrade (Red Hat).

Security Fix(es) :

  - It was found that the fix for CVE-2015-3148 in curl was     incomplete. An application using libcurl with HTTP     Negotiate authentication could incorrectly re-use     credentials for subsequent requests to the same server.
    (CVE-2017-2628)

The remote OracleVM system is missing necessary patches to address critical security updates :

  - treat Negotiate authentication as connection-oriented     (CVE-2017-2628)

  - fix a bug in DNS caching code that causes a memory leak     (#1302893)

  - SSH: make CURLOPT_SSH_PUBLIC_KEYFILE treat '' as NULL     (#1260742)

  - use the default min/max TLS version provided by NSS     (#1289205)

  - prevent NSS from incorrectly re-using a session     (#1269660)

  - prevent test46 from failing due to expired cookie     (#1277551)

  - SSH: do not require public key file for user     authentication (#1260742)

  - make SCP/SFTP work with --proxytunnel (#1258566)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-0847 advisory.

    [7.19.7-53]
    - treat Negotiate authentication as connection-oriented (CVE-2017-2628)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
146611	F5 Networks BIG-IP : cURL and libcurl vulnerability (K35453761)	Nessus	F5 Networks Local Security Checks	critical
127334	NewStart CGSL MAIN 4.05 : curl Vulnerability (NS-SA-2019-0104)	Nessus	NewStart CGSL Local Security Checks	critical
99335	RHEL 6 : curl (RHSA-2017:0847)	Nessus	Red Hat Local Security Checks	critical
99229	Scientific Linux Security Update : curl on SL6.x i386/x86_64 (20170329)	Nessus	Scientific Linux Local Security Checks	critical
99113	OracleVM 3.3 / 3.4 : curl (OVMSA-2017-0059)	Nessus	OracleVM Local Security Checks	critical
99075	Oracle Linux 6 : curl (ELSA-2017-0847)	Nessus	Oracle Linux Local Security Checks	critical

Detections

Analytics

CVE-2017-2628

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical