Detections
Analytics

openSUSE Security Update : curl (openSUSE-2015-125)

medium Nessus Plugin ID 81287

Language:

Synopsis

The remote openSUSE host is missing a security update.

Description

was updated to version 7.40.0 to fix two security issues.

These security issues were fixed :

 - CVE-2014-8150: CRLF injection vulnerability in libcurl 6.0 through 7.x before 7.40.0, when using an HTTP proxy, allowed remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in a URL (bnc#911363).

 - CVE-2014-3707: The curl_easy_duphandle function in libcurl 7.17.1 through 7.38.0, when running with the CURLOPT_COPYPOSTFIELDS option, did not properly copy HTTP POST data for an easy handle, which triggered an out-of-bounds read that allowed remote web servers to read sensitive memory information (bnc#901924).

These non-security issues were fixed :

- http_digest: Added support for Windows SSPI based authentication

 - version info: Added Kerberos V5 to the supported features

 - Makefile: Added VC targets for WinIDN

 - SSL: Add PEM format support for public key pinning

 - smtp: Added support for the conversion of Unix newlines during mail send

 - smb: Added initial support for the SMB/CIFS protocol

 - Added support for HTTP over unix domain sockets,

 - via CURLOPT_UNIX_SOCKET_PATH and --unix-socket

 - sasl: Added support for GSS-API based Kerberos V5 authentication

Solution

Update the affected curl packages.

See Also

https://bugzilla.opensuse.org/show_bug.cgi?id=901924

https://bugzilla.opensuse.org/show_bug.cgi?id=911363

Plugin Details

Severity: Medium

ID: 81287

File Name: openSUSE-2015-125.nasl

Version: 1.4

Type: local

Agent: unix

Published: 2/11/2015

Updated: 1/19/2021

Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:novell:opensuse:curl, p-cpe:/a:novell:opensuse:libcurl4, cpe:/o:novell:opensuse:13.2, p-cpe:/a:novell:opensuse:libcurl4-32bit, p-cpe:/a:novell:opensuse:curl-debugsource, cpe:/o:novell:opensuse:13.1, p-cpe:/a:novell:opensuse:curl-debuginfo, p-cpe:/a:novell:opensuse:libcurl4-debuginfo, p-cpe:/a:novell:opensuse:libcurl-devel, p-cpe:/a:novell:opensuse:libcurl4-debuginfo-32bit

Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu

Patch Publication Date: 2/3/2015

Reference Information

CVE: CVE-2014-3707, CVE-2014-8150