Detections
Analytics
SuSE 10 Security Update : libcurl4 (ZYPP Patch Number 8618) (BEAST)
medium Nessus Plugin ID 67223
Language:
Synopsis
The remote SuSE 10 host is missing a security-related patch.Description
This update of curl fixes several security issues :- libcurl URL decode buffer boundary flaw. (bnc#824517 / CVE-2013-2174)
- cookie domain tailmatch. (bnc#814655 / CVE-2013-1944)
- curl sets SSL_OP_ALL. (bnc#742306 / CVE-2011-3389)
- When SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG is enabled, does not properly prevent modification of the ciphersuite in the session cache, which allows remote attackers to force the downgrade to an unintended cipher via vectors involving sniffing network traffic to discover a session identifier. (CVE-2010-4180)
Solution
Apply ZYPP patch number 8618.See Also
http://support.novell.com/security/cve/CVE-2010-4180.html
http://support.novell.com/security/cve/CVE-2011-3389.html
Plugin Details
Severity: Medium
ID: 67223
File Name: suse_libcurl4-8618.nasl
Version: 1.6
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 7/10/2013
Updated: 12/5/2022
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P
Vulnerability Information
CPE: cpe:/o:suse:suse_linux
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Patch Publication Date: 6/17/2013
Vulnerability Publication Date: 12/6/2010
Reference Information
CVE: CVE-2010-4180, CVE-2011-3389, CVE-2013-1944, CVE-2013-2174