libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This leads to the overwriting of nearby stack memory. The content of the overwrite is decided by the `free()` implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this flaw is a crash, although it cannot be ruled out that more serious results can be had in special circumstances.

The remote Windows host is missing security update 5044285. It is, therefore, affected by multiple vulnerabilities

  - libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect     an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte     localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some     however accept the input pointer and add that memory to its list of available chunks. This leads to the     overwriting of nearby stack memory. The content of the overwrite is decided by the `free()`     implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this     flaw is a crash, although it cannot be ruled out that more serious results can be had in special     circumstances. (CVE-2024-6197)   
  - Remote Desktop Client Remote Code Execution Vulnerability (CVE-2024-43599)

  - An attacker could exploit a use after free vulnerability within the OS SAPI component to execute     arbitrary code in the context of the compromised user to disclose sensitive information, compromise     system integrity or impact the availability of the victim's system. (CVE-2024-43574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5044284. It is, therefore, affected by multiple vulnerabilities

  - libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect     an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte     localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some     however accept the input pointer and add that memory to its list of available chunks. This leads to the     overwriting of nearby stack memory. The content of the overwrite is decided by the `free()`     implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this     flaw is a crash, although it cannot be ruled out that more serious results can be had in special     circumstances. (CVE-2024-6197)     
  - Remote Desktop Client Remote Code Execution Vulnerability (CVE-2024-43599)

  - An attacker could exploit a use after free vulnerability within the OS SAPI component to execute     arbitrary code in the context of the compromised user to disclose sensitive information, compromise     system integrity or impact the availability of the victim's system. (CVE-2024-43574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5044288. It is, therefore, affected by multiple vulnerabilities

  - libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect     an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte     localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some     however accept the input pointer and add that memory to its list of available chunks. This leads to the     overwriting of nearby stack memory. The content of the overwrite is decided by the `free()`     implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this     flaw is a crash, although it cannot be ruled out that more serious results can be had in special     circumstances. (CVE-2024-6197)

  - Remote Desktop Client Remote Code Execution Vulnerability (CVE-2024-43599)

  - An attacker could exploit a use after free vulnerability within the OS SAPI component to execute     arbitrary code in the context of the compromised user to disclose sensitive information, compromise     system integrity or impact the availability of the victim's system. (CVE-2024-43574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5044280. It is, therefore, affected by multiple vulnerabilities

  - libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect     an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte     localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some     however accept the input pointer and add that memory to its list of available chunks. This leads to the     overwriting of nearby stack memory. The content of the overwrite is decided by the `free()`     implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this     flaw is a crash, although it cannot be ruled out that more serious results can be had in special     circumstances. (CVE-2024-6197)

  - Remote Desktop Client Remote Code Execution Vulnerability (CVE-2024-43599)

  - An attacker could exploit a use after free vulnerability within the OS SAPI component to execute     arbitrary code in the context of the compromised user to disclose sensitive information, compromise     system integrity or impact the availability of the victim's system. (CVE-2024-43574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5044281. It is, therefore, affected by multiple vulnerabilities

  - libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect     an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte     localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some     however accept the input pointer and add that memory to its list of available chunks. This leads to the     overwriting of nearby stack memory. The content of the overwrite is decided by the `free()`     implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this     flaw is a crash, although it cannot be ruled out that more serious results can be had in special     circumstances. (CVE-2024-6197)

  - Remote Desktop Client Remote Code Execution Vulnerability (CVE-2024-43599)

  - An attacker could exploit a use after free vulnerability within the OS SAPI component to execute     arbitrary code in the context of the compromised user to disclose sensitive information, compromise     system integrity or impact the availability of the victim's system. (CVE-2024-43574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5044273. It is, therefore, affected by multiple vulnerabilities

  - libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect     an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte     localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some     however accept the input pointer and add that memory to its list of available chunks. This leads to the     overwriting of nearby stack memory. The content of the overwrite is decided by the `free()`     implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this     flaw is a crash, although it cannot be ruled out that more serious results can be had in special     circumstances. (CVE-2024-6197)

  - Remote Desktop Client Remote Code Execution Vulnerability (CVE-2024-43599)

  - An attacker could exploit a use after free vulnerability within the OS SAPI component to execute     arbitrary code in the context of the compromised user to disclose sensitive information, compromise     system integrity or impact the availability of the victim's system. (CVE-2024-43574)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5044277. It is, therefore, affected by multiple vulnerabilities

  - libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect     an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte     localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some     however accept the input pointer and add that memory to its list of available chunks. This leads to the     overwriting of nearby stack memory. The content of the overwrite is decided by the `free()`     implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this     flaw is a crash, although it cannot be ruled out that more serious results can be had in special     circumstances. (CVE-2024-6197)   
  - Remote Desktop Client Remote Code Execution Vulnerability (CVE-2024-43599)

  - An unauthenticated attacker could send a specially crafted protocol message to a Routing and Remote     Access Service (RRAS) server, which could lead to remote code execution (RCE) on the RAS server machine.
    (CVE-2024-43607)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.0. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-17 advisory.

  - Nessus Network Monitor leverages third-party software to help provide underlying functionality. Several of     the third-party components (OpenSSL, expat, curl, and libxml2)were found to contain vulnerabilities,     and updated versions have been made available by the providers.Out of caution and in line with best     practice, Tenable has opted to upgrade these components to address the potential impact of the issues.
    Nessus Network Monitor 6.5.0 updates OpenSSL to version 3.0.15, expat to version 2.6.3, curl to version     8.10.0, and libxml2 to to version 2.13.1 to address the identified vulnerabilities.Additionally, one     separate vulnerability was discovered, reported and fixed:A stored cross site scripting vulnerability     exists in Nessus Network Monitor where an authenticated, privileged local attacker could inject arbitrary     code into the NNM UI via the local CLI. - CVE-2024-9158 Tenable has released Nessus Network Monitor 6.5.0     to address these issues. The installation files can be obtained from the Tenable Downloads Portal     (https://www.tenable.com/downloads/nessus-network-monitor). (CVE-2024-34459, CVE-2024-45491,     CVE-2024-45492, CVE-2024-6119, CVE-2024-6197, CVE-2024-7264, CVE-2024-8096, CVE-2024-9158)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of curl installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-6197 advisory.

  - libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect     an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte     localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some     however accept the input pointer and add that memory to its list of available chunks. This leads to the     overwriting of nearby stack memory. The content of the overwrite is decided by the `free()`     implementation; likely to be memory pointers and a set of flags. The most likely outcome of exploting this     flaw is a crash, although it cannot be ruled out that more serious results can be had in special     circumstances. (CVE-2024-6197)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable Security Center running on the remote host is 6.2.1, 6.3.0 or 6.4.0.
It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2024-13 advisory.

  - Security Center leverages third-party software to help provide underlying functionality. Several of the     third-party components (Apache, libcurl) were found to contain vulnerabilities, and updated versions have     been made available by the providers.Out of caution and in line with best practice, Tenable has opted to     upgrade these components to address the potential impact of the issues. Security Center Patch SC-202408.1     updates Apache to version 2.4.62 and libcurl to version 8.8.0 to address the identified vulnerabilities.
    Tenable has released Security Center Patch SC-202408.1 to address these issues. The installation files can     be obtained from the Tenable Downloads Portal: https://www.tenable.com/downloads/security-center     (CVE-2024-2004, CVE-2024-2379, CVE-2024-2398, CVE-2024-2466, CVE-2024-36387, CVE-2024-38472,     CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476, CVE-2024-38477, CVE-2024-39573,     CVE-2024-39884, CVE-2024-40725, CVE-2024-40898, CVE-2024-6197, CVE-2024-6874)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:2784-1 advisory.

    - CVE-2024-7264: Fixed ASN.1 date parser overread (bsc#1228535)
    - CVE-2024-6197: Fixed freeing stack buffer in utf8asn1str (bsc#1227888)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-a7976ba89f advisory.

    - fix freeing stack buffer in utf8asn1str (CVE-2024-6197)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

ID	Name	Product	Family	Severity
208304	KB5044285: Windows 11 version 22H2 / 23H2 Security Update (October 2024)	Nessus	Windows : Microsoft Bulletins	high
208302	KB5044284: Windows 11 Version 24H2 Security Update (October 2024)	Nessus	Windows : Microsoft Bulletins	high
208301	KB5044288: Windows 11 version 22H2 / Windows Server version 23H2 Security Update (October 2024)	Nessus	Windows : Microsoft Bulletins	critical
208296	KB5044280: Windows 11 version 21H2 Security Update (October 2024)	Nessus	Windows : Microsoft Bulletins	high
208295	KB5044281: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (October 2024)	Nessus	Windows : Microsoft Bulletins	critical
208292	KB5044273: Windows 10 version 21H2 / Windows 10 Version 22H2 Security Update (October 2024)	Nessus	Windows : Microsoft Bulletins	high
208285	KB5044277: Windows 10 version 1809 / Windows Server 2019 Security Update (October 2024)	Nessus	Windows : Microsoft Bulletins	critical
207713	Nessus Network Monitor < 6.5.0 Multiple Vulnerabilities (TNS-2024-17)	Nessus	Misc.	critical
207263	CBL Mariner 2.0 Security Update: curl (CVE-2024-6197)	Nessus	MarinerOS Local Security Checks	high
205527	Tenable Security Center Multiple Vulnerabilities (TNS-2024-13)	Nessus	Misc.	critical
205127	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : curl (SUSE-SU-2024:2784-1)	Nessus	SuSE Local Security Checks	high
204845	Fedora 40 : curl (2024-a7976ba89f)	Nessus	Fedora Local Security Checks	high
204661	Photon OS 5.0: Curl PHSA-2024-5.0-0328	Nessus	PhotonOS Local Security Checks	high
204659	Photon OS 4.0: Curl PHSA-2024-4.0-0658	Nessus	PhotonOS Local Security Checks	high

Detections

Analytics

CVE-2024-6197

high

Tenable Plugins

high

high

critical

high

critical

high

critical

critical

high

critical

high

high

high

high