The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a '%' character, which leads to a heap-based buffer over-read.

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - curl: FTP wildcard out of bounds read (CVE-2017-8817)

  - CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allows     remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF     sequences in a URL. (CVE-2014-8150)

  - The default configuration for cURL and libcurl before 7.42.1 sends custom HTTP headers to both the proxy     and destination server, which might allow remote proxy servers to obtain sensitive information by reading     the header contents. (CVE-2015-3153)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3558 advisory.

  - curl: TLS session resumption client cert bypass (CVE-2016-5419)

  - curl: Re-using connection with wrong client cert (CVE-2016-5420)

  - curl: Use of connection struct after free (CVE-2016-5421)

  - curl: Incorrect reuse of client certificates (CVE-2016-7141)

  - curl: escape and unescape integer overflows (CVE-2016-7167)

  - curl: Cookie injection for other servers (CVE-2016-8615)

  - curl: Case insensitive password comparison (CVE-2016-8616)

  - curl: Out-of-bounds write via unchecked multiplication (CVE-2016-8617)

  - curl: Double-free in curl_maprintf (CVE-2016-8618)

  - curl: Double-free in krb5 code (CVE-2016-8619)

  - curl: Glob parser write/read out of bounds (CVE-2016-8620)

  - curl: curl_getdate out-of-bounds read (CVE-2016-8621)

  - curl: URL unescape heap overflow via integer truncation (CVE-2016-8622)

  - curl: Use-after-free via shared cookies (CVE-2016-8623)

  - curl: Invalid URL parsing with '#' (CVE-2016-8624)

  - curl: IDNA 2003 makes curl use wrong host (CVE-2016-8625)

  - curl: printf floating point buffer overflow (CVE-2016-9586)

  - curl: --write-out out of bounds read (CVE-2017-7407)

  - curl: NTLM buffer overflow via integer overflow (CVE-2017-8816)

  - curl: FTP wildcard out of bounds read (CVE-2017-8817)

  - httpd: Out of bounds write in mod_authnz_ldap when using too small Accept-Language values (CVE-2017-15710)

  - httpd: <FilesMatch> bypass with a trailing newline in the file name (CVE-2017-15715)

  - curl: TFTP sends more than buffer size (CVE-2017-1000100)

  - curl: URL globbing out of bounds read (CVE-2017-1000101)

  - curl: FTP PWD response parser out of bounds read (CVE-2017-1000254)

  - curl: IMAP FETCH response out of bounds read (CVE-2017-1000257)

  - httpd: Improper handling of headers in mod_session can allow a remote user to modify session data for CGI     applications (CVE-2018-1283)

  - httpd: Out of bounds access after failure in reading the HTTP request (CVE-2018-1301)

  - httpd: Out of bounds read in mod_cache_socache can allow a remote attacker to cause DoS (CVE-2018-1303)

  - httpd: Weak Digest auth nonce generation in mod_auth_digest (CVE-2018-1312)

  - httpd: mod_http2: Too much time allocated to workers, possibly leading to DoS (CVE-2018-1333)

  - httpd: DoS for HTTP/2 connections by continuous SETTINGS frames (CVE-2018-11763)

  - curl: NTLM password overflow via integer overflow (CVE-2018-14618)

  - curl: HTTP authentication leak in redirects (CVE-2018-1000007)

  - curl: FTP path trickery leads to NIL byte out of bounds write (CVE-2018-1000120)

  - curl: LDAP NULL pointer dereference (CVE-2018-1000121)

  - curl: RTSP RTP buffer over-read (CVE-2018-1000122)

  - curl: Out-of-bounds heap read when missing RTSP headers allows information leak or denial of service     (CVE-2018-1000301)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A heap buffer overflow in the TFTP receiving code     allows for DoS or arbitrary code execution in libcurl     versions 7.19.4 through 7.64.1.(CVE-2019-5436)

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.(CVE-2017-7407)

  - Curl versions 7.14.1 through 7.61.1 are vulnerable to a     heap-based buffer over-read in the tool_msgs.c:voutf()     function that may result in information exposure and     denial of service.(CVE-2018-16842)

  - The ConnectionExists function in lib/url.c in libcurl     before 7.47.0 does not properly re-use     NTLM-authenticated proxy connections, which might allow     remote attackers to authenticate as other users via a     request, a similar issue to     CVE-2014-0015.(CVE-2016-0755)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.(CVE-2017-7407)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the curl packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.(CVE-2017-7407)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.(CVE-2017-7407)

  - The ConnectionExists function in lib/url.c in libcurl     before 7.47.0 does not properly re-use     NTLM-authenticated proxy connections, which might allow     remote attackers to authenticate as other users via a     request, a similar issue to     CVE-2014-0015.(CVE-2016-0755)

  - Curl versions 7.14.1 through 7.61.1 are vulnerable to a     heap-based buffer over-read in the tool_msgs.c:voutf()     function that may result in information exposure and     denial of service.(CVE-2018-16842)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - cURL and libcurl 7.18.0 through 7.32.0, when built with     OpenSSL, disables the certificate CN and SAN name field     verification (CURLOPT_SSL_VERIFYHOST) when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid     certificate.i1/4^CVE-2013-4545i1/4%0

  - The GnuTLS backend in libcurl 7.21.4 through 7.33.0,     when disabling digital signature verification     (CURLOPT_SSL_VERIFYPEER), also disables the     CURLOPT_SSL_VERIFYHOST check for CN or SAN host name     fields, which makes it easier for remote attackers to     spoof servers and conduct man-in-the-middle (MITM)     attacks.i1/4^CVE-2013-6422i1/4%0

  - cURL and libcurl 7.1 before 7.36.0, when using the     OpenSSL, axtls, qsossl or gskit libraries for TLS,     recognize a wildcard IP address in the subject's Common     Name (CN) field of an X.509 certificate, which might     allow man-in-the-middle attackers to spoof arbitrary     SSL servers via a crafted certificate issued by a     legitimate Certification Authority.i1/4^CVE-2014-0139i1/4%0

  - curl and libcurl 7.27.0 through 7.35.0, when running on     Windows and using the SChannel/Winssl TLS backend, does     not verify that the server hostname matches a domain     name in the subject's Common Name (CN) or     subjectAltName field of the X.509 certificate when     accessing a URL that uses a numerical IP address, which     allows man-in-the-middle attackers to spoof servers via     an arbitrary valid certificate.i1/4^CVE-2014-2522i1/4%0

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.i1/4^CVE-2017-7407i1/4%0

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external     entities.i1/4^CVE-2018-1000007i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the remote pfSense install is affected by multiple vulnerabilities as stated in the referenced vendor advisories.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3441-1 advisory.

    Daniel Stenberg discovered that curl incorrectly handled large floating point output. A remote attacker     could use this issue to cause curl to crash, resulting in a denial of service, or possibly execute     arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-9586)

    Even Rouault discovered that curl incorrectly handled large file names when doing TFTP transfers. A remote     attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly obtain     sensitive memory contents. (CVE-2017-1000100)

    Brian Carpenter and Yongji Ouyang discovered that curl incorrectly handled numerical range globbing. A     remote attacker could use this issue to cause curl to crash, resulting in a denial of service, or possibly     obtain sensitive memory contents. (CVE-2017-1000101)

    Max Dymond discovered that curl incorrectly handled FTP PWD responses. A remote attacker could use this     issue to cause curl to crash, resulting in a denial of service. (CVE-2017-1000254)

    Brian Carpenter discovered that curl incorrectly handled the --write-out command line option. A local     attacker could possibly use this issue to obtain sensitive memory contents. (CVE-2017-7407)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201709-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    Remote attackers could cause a Denial of Service condition, obtain       sensitive information, or bypass intended restrictions for TLS sessions.
  Workaround :

    There is no known workaround at this time.

This update for curl fixes the following issues :

  - CVE-2017-1000100: TFP sends more than buffer size and it     could lead to a denial of service (bsc#1051644)

  - CVE-2017-7407: ourWriteOut function problem could lead     to a heap buffer over-read (bsc#1032309)

  - CVE-2016-9586: libcurl printf issue could lead to buffer     overflow (bsc#1015332)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- fix out of bounds read in curl --write-out     (CVE-2017-7407)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The ourWriteOut function in tool_writeout.c in curl 7.53.1 might allow physically proximate attackers to obtain sensitive information from process memory in opportunistic circumstances by reading a workstation screen during use of a --write-out argument ending in a certain character, which leads to a heap-based buffer over-read.(CVE-2017-7407 )

This update for curl fixes the following issues :

Security issue fixed :

  - CVE-2016-9586: libcurl printf floating point buffer     overflow (bsc#1015332)

  - CVE-2017-7407: The ourWriteOut function in     tool_writeout.c in curl might have allowed physically     proximate attackers to obtain sensitive information from     process memory in opportunistic circumstances by reading     a workstation screen during use of a --write-out     argument ending in a '%' character, which lead to a     heap-based buffer over-read (bsc#1032309).

With this release new default ciphers are active (SUSE_DEFAULT, bsc#1027712).

This update was imported from the SUSE:SLE-12:Update update project.

This update for curl fixes the following issues: These security issues were fixed :

  - CVE-2016-9586: libcurl printf floating point buffer     overflow (bsc#1015332)

  - CVE-2017-7407: The ourWriteOut function in     tool_writeout.c in curl might have allowed physically     proximate attackers to obtain sensitive information from     process memory in opportunistic circumstances by reading     a workstation screen during use of a --write-out     argument ending in a '%' character, which lead to a     heap-based buffer over-read (bsc#1032309).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for curl fixes the following issues: Security issue fixed :

  - CVE-2016-9586: libcurl printf floating point buffer     overflow (bsc#1015332)

  - CVE-2017-7407: The ourWriteOut function in     tool_writeout.c in curl might have allowed physically     proximate attackers to obtain sensitive information from     process memory in opportunistic circumstances by reading     a workstation screen during use of a --write-out     argument ending in a '%' character, which lead to a     heap-based buffer over-read (bsc#1032309). With this     release new default ciphers are active (SUSE_DEFAULT,     bsc#1027712).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The cURL project reports :

There were two bugs in curl's parser for the command line option
--write-out (or -w for short) that would skip the end of string zero byte if the string ended in a % (percent) or \ (backslash), and it would read beyond that buffer in the heap memory and it could then potentially output pieces of that memory to the terminal or the target file etc..

This flaw only exists in the command line tool.

We are not aware of any exploit of this flaw.

It was discovered that there was a buffer read overrun vulnerability in curl, a tool for downloading files from the internet, etc.

If a '%' ended the --write-out parameter, the string's trailing NUL would be skipped and memory past the end of the buffer could be accessed and potentially displayed as part of the output.

For Debian 7 'Wheezy', this issue has been fixed in curl version 7.26.0-1+wheezy18+deb7u1.

We recommend that you upgrade your curl packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	critical
198450	RHEL 7 : curl (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
194113	RHEL 6 / 7 : httpd24 (RHSA-2018:3558)	Nessus	Red Hat Local Security Checks	critical
129247	EulerOS 2.0 SP3 : curl (EulerOS-SA-2019-2054)	Nessus	Huawei Local Security Checks	critical
126878	EulerOS 2.0 SP2 : curl (EulerOS-SA-2019-1751)	Nessus	Huawei Local Security Checks	low
126539	EulerOS Virtualization for ARM 64 3.0.2.0 : curl (EulerOS-SA-2019-1697)	Nessus	Huawei Local Security Checks	low
126292	EulerOS 2.0 SP5 : curl (EulerOS-SA-2019-1665)	Nessus	Huawei Local Security Checks	critical
123858	EulerOS Virtualization 2.5.3 : curl (EulerOS-SA-2019-1172)	Nessus	Huawei Local Security Checks	critical
106504	pfSense < 2.3.4 Multiple Vulnerabilities (SA-17_04)	Nessus	Firewalls	critical
103773	Ubuntu 14.04 LTS / 16.04 LTS : curl vulnerabilities (USN-3441-1)	Nessus	Ubuntu Local Security Checks	high
103282	GLSA-201709-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
102910	SUSE SLES11 Security Update : curl (SUSE-SU-2017:2312-1)	Nessus	SuSE Local Security Checks	high
101737	Fedora 26 : curl (2017-e396614cd0)	Nessus	Fedora Local Security Checks	low
101003	Amazon Linux AMI : curl (ALAS-2017-850)	Nessus	Amazon Linux Local Security Checks	low
99702	openSUSE Security Update : curl (openSUSE-2017-513)	Nessus	SuSE Local Security Checks	high
99465	SUSE SLES11 Security Update : curl (SUSE-SU-2017:1043-1)	Nessus	SuSE Local Security Checks	high
99464	SUSE SLED12 / SLES12 Security Update : curl (SUSE-SU-2017:1042-1)	Nessus	SuSE Local Security Checks	high
99258	Fedora 25 : curl (2017-b38b98727e)	Nessus	Fedora Local Security Checks	low
99206	FreeBSD : cURL -- potential memory disclosure (04f29189-1a05-11e7-bc6e-b499baebfeaf)	Nessus	FreeBSD Local Security Checks	low
99188	Debian DLA-883-1 : curl security update	Nessus	Debian Local Security Checks	low

Detections

Analytics

CVE-2017-7407

low

Tenable Plugins

critical

critical

critical

critical

low

low

critical

critical

critical

high

high

high

low

low

high

high

high

low

low

low