Detections
Analytics

Curl < 7.15.1 Multiple Remote Overflows

critical Nessus Network Monitor Plugin ID 3318

Synopsis

The remote host is vulnerable to a buffer overflow.

Description

The remote host is using a version of curl (or libcurl) that is vulnerable to a remote buffer overflows. To exploit, an attacker would have to set up a rogue web server and entice a curl user into browsing to the malicious server. Upon successful exploitation, the attacker would be able to execute arbitrary commands with the rights of the web server.

Solution

Upgrade or patch according to vendor recommendations.

See Also

http://curl.haxx.se/docs/adv_20051207.html

Plugin Details

Severity: Critical

ID: 3318

Family: Web Clients

Published: 12/7/2005

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:haxx:curl

Reference Information

CVE: CVE-2005-2337, CVE-2005-2628, CVE-2005-4077, CVE-2006-0024, CVE-2006-1439, CVE-2006-1440, CVE-2006-1441, CVE-2006-1442, CVE-2006-1443, CVE-2006-1444, CVE-2006-1445, CVE-2006-1446, CVE-2006-1447, CVE-2006-1448, CVE-2006-1449, CVE-2006-1450, CVE-2006-1451, CVE-2006-1452, CVE-2006-1453, CVE-2006-1454, CVE-2006-1455, CVE-2006-1456, CVE-2006-1457, CVE-2006-1552, CVE-2006-1614, CVE-2006-1615, CVE-2006-1630, CVE-2006-1982, CVE-2006-1983, CVE-2006-1984, CVE-2006-1985

BID: 17951, 15756