The version of curl installed on the remote host is prior to 8.3.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2023-2287 advisory.

    An issue was found in curl that can cause a buffer overflow in its SOCKS5 proxy communications code.

    When curl is using a SOCKS5 proxy and it needs to resolve a hostname to an IP address, its default     behavior is to pass the hostname to the proxy and allow it to perform the resolution. In cases where the     hostname is greater than 255 characters in length, curl will instead attempt to perform the resolution     locally and then pass the resolved IP to the proxy for its use. Due to an issue in the curl source code,     the logic that determines whether curl should resolve the name locally or pass it to the proxy for     resolution could make an incorrect decision when a slow SOCKS5 handshake occurs. If this occurs, curl may     inadvertently copy an excessively long host name, rather than the resolved address, into the target buffer     being prepared for transmission to the proxy, resulting in a buffer overflow. (CVE-2023-38545)

    An issue was found in libcurl which allows cookies to be inserted into a running program if specific     conditions are met. The libcurl provided function, curl_easy_duphandle(), is used to duplicate the     easy_handle associated with a transfer. If a duplicated transfer's easy_handle has cookies enabled when it     is duplicated, the cookie-enabled state is cloned but the actual cookies are not. If the source     easy_handle didn't read cookies from disk, the cloned easy_handle will attempt to read cookies from a file     named 'none' in the local directory, potentially allowing arbitrary cookies to be loaded. (CVE-2023-38546)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : curl (ALAS-2023-2287)

critical Nessus Plugin ID 182948

Version 1.7