curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session. (CVE-2016-5419)

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.
(CVE-2016-5420)

libcurl before 7.50.1 allows attackers to control which connection is used or possibly have unspecified other impact via unknown vectors.
(CVE-2016-5421)

This update for curl fixes the following issues :

  - fixing a performance regression with FTP (boo#991746)

  - TLS session resumption client cert bypass (boo#991389,     CVE-2016-5419)

  - Re-using connections with wrong client cert (boo#991390,     CVE-2016-5420)

  - use of connection struct after free (boo#991391,     CVE-2016-5421)

The version of Tenable Log Correlation Engine (LCE) installed on the remote host is prior to 4.8.1. It is, therefore, affected by the following vulnerabilities :

  - Multiple cross-site scripting (XSS) vulnerabilities     exist in the Handlebars library in the     lib/handlebars/utils.js script due to a failure to     properly escape input passed as unquoted attributes to     templates. An unauthenticated, remote attacker can     exploit these vulnerabilities, via a specially crafted     request, to execute arbitrary script code in a user's     browser session. (CVE-2015-8861, CVE-2015-8862)

  - A heap-based buffer overflow condition exists in the     Perl-Compatible Regular Expressions (PCRE) component     that is triggered when processing nested back references     in a duplicate named group. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1283)

  - An out-of-bounds read error exists in the libxml2     component in parserInternals.c due to improper parsing     of characters in an XML file. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1833)

  - An overflow condition exists in the libxml2 component in     xmlstring.c due to improper validation of user-supplied     input when handling a string with NULL. An     unauthenticated, remote attacker can exploit this, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1834)

  - Multiple use-after-free errors exist in the libxml2     component in parser.c that is triggered when parsing     complex names. An unauthenticated, remote attacker can     exploit these issues, via a specially crafted file, to     dereference already freed memory and potentially execute     arbitrary code. (CVE-2016-1835, CVE-2016-1836)

  - Multiple heap-based buffer overflow conditions exist in     the libxml2 component in HTMLparser.c and xmlregexp.c     due to improper validation of user-supplied input when     parsing characters in a range. An unauthenticated,     remote attacker can exploit these issues, via a     specially crafted file, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-1837, CVE-2016-1839, CVE-2016-1840)

  - Multiple out-of-bounds read errors exist in the libxml2     component in parser.c. An unauthenticated, remote     attacker can exploit these issues to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-1838, CVE-2016-4447)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncodeUpdate() function within file     crypto/evp/encode.c that is triggered when handling a     large amount of input data. An unauthenticated, remote     attacker can exploit this to cause a denial of service     condition. (CVE-2016-2105)

  - A heap buffer overflow condition exists in the OpenSSL     component in the EVP_EncryptUpdate() function within     file crypto/evp/evp_enc.c that is triggered when     handling a large amount of input data after a previous     call occurs to the same function with a partial block.
    An unauthenticated, remote attacker can exploit this to     cause a denial of service condition. (CVE-2016-2106)

  - Flaws exist in the aesni_cbc_hmac_sha1_cipher()     function in file crypto/evp/e_aes_cbc_hmac_sha1.c and     the aesni_cbc_hmac_sha256_cipher() function in file     crypto/evp/e_aes_cbc_hmac_sha256.c that are triggered     when the connection uses an AES-CBC cipher and AES-NI     is supported by the server. A man-in-the-middle attacker     can exploit these to conduct a padding oracle attack,     resulting in the ability to decrypt the network traffic.
    (CVE-2016-2107)

  - A remote code execution vulnerability exists in the     OpenSSL component in the ASN.1 encoder due to an     underflow condition that occurs when attempting to     encode the value zero represented as a negative integer.
    An unauthenticated, remote attacker can exploit this to     corrupt memory, resulting in the execution of arbitrary     code. (CVE-2016-2108)

  - Multiple unspecified flaws exist in the d2i BIO     functions when reading ASN.1 data from a BIO due to     invalid encoding causing a large allocation of memory.
    An unauthenticated, remote attacker can exploit these to     cause a denial of service condition through resource     exhaustion. (CVE-2016-2109)

  - An out-of-bounds read error exists in the     X509_NAME_oneline() function within file     crypto/x509/x509_obj.c when handling very long ASN1     strings. An unauthenticated, remote attacker can exploit     this to disclose the contents of stack memory.
    (CVE-2016-2176)

  - An overflow condition exists in the Perl-Compatible     Regular Expressions (PCRE) component due to improper     validation of user-supplied input when handling the     (*ACCEPT) verb. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2016-3191)

  - A flaw exists in the libxml2 component in parser.c that     occurs when handling XML content in recovery mode. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3627)

  - A flaw exists in the libxml2 component in parser.c due     to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit this to     cause a stack exhaustion, resulting in a denial of     service condition. (CVE-2016-3705)

  - A format string flaw exists in the libxml2 component due     to improper use of string format specifiers (e.g. %s and     %x). An unauthenticated, remote attacker can exploit     this to cause a denial of service condition or the     execution of arbitrary code. (CVE-2016-4448)

  - An XML external entity injection vulnerability exists in     parser.c due to improper parsing of XML data. An     unauthenticated, remote attacker can exploit this, via     specially crafted XML data, to disclose arbitrary files     or cause a denial of service condition. (CVE-2016-4449)

  - An out-of-bounds read error exists in the libxml2     component in xmlsave.c that occurs when handling XML     content in recovery mode. An unauthenticated, remote     attacker can exploit this to disclose sensitive     information or cause a denial of service condition.
    (CVE-2016-4483)

  - A security bypass vulnerability exists in the libcurl     component due to the program attempting to resume TLS     sessions even if the client certificate fails. An     unauthenticated, remote attacker can exploit this to     bypass validation mechanisms. (CVE-2016-5419)

  - An information disclosure vulnerability exists in the     libcurl component due to the program reusing TLS     connections with different client certificates. An     unauthenticated, remote attacker can exploit this to     disclose sensitive cross-realm information.
    (CVE-2016-5420)

  - A use-after-free error exists in the libcurl component     that is triggered as connection pointers are not     properly cleared for easy handles. An unauthenticated,     remote attacker can exploit this to dereference already     freed memory, potentially resulting in the execution of     arbitrary code. (CVE-2016-5421)

  - Multiple stored cross-site scripting (XSS)   	vulnerabilities exist due to improper validation of   	user-supplied input. An authenticated, remote attacker   	can exploit these, via a specially crafted request, to   	execute arbitrary script code in a user's browsers   	session. (CVE-2016-9261)

The remote NewStart CGSL host, running version MAIN 6.02, has curl packages installed that are affected by multiple vulnerabilities:

  - The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is     enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary     requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3)     execute arbitrary commands via a redirect to an scp: URL. (CVE-2009-0037)

  - The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl     and other products, always performs credential delegation during GSSAPI authentication, which allows     remote servers to impersonate clients via GSSAPI requests. (CVE-2011-2192)

  - curl and libcurl 7.2x before 7.24.0 do not properly consider special characters during extraction of a     pathname from a URL, which allows remote attackers to conduct data-injection attacks via a crafted URL, as     demonstrated by a CRLF injection attack on the (1) IMAP, (2) POP3, or (3) SMTP protocol. (CVE-2012-0036)

  - Stack-based buffer overflow in the Curl_sasl_create_digest_md5_message function in lib/curl_sasl.c in curl     and libcurl 7.26.0 through 7.28.1, when negotiating SASL DIGEST-MD5 authentication, allows remote     attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in     the realm parameter in a (1) POP3, (2) SMTP or (3) IMAP message. (CVE-2013-0249)

  - The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path     domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the     domain of a URL. (CVE-2013-1944)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS that is 10.12.x prior to 10.12.2. It is, therefore, affected by multiple vulnerabilities in the following components :

  - apache_mod_php
  - AppleGraphicsPowerManagement
  - Assets
  - Audio
  - Bluetooth
  - CoreCapture
  - CoreFoundation
  - CoreGraphics
  - CoreMedia External Displays
  - CoreMedia Playback
  - CoreStorage
  - CoreText
  - curl
  - Directory Services
  - Disk Images
  - FontParser
  - Foundation
  - Grapher
  - ICU
  - ImageIO
  - Intel Graphics Driver
  - IOFireWireFamily
  - IOAcceleratorFamily
  - IOHIDFamily
  - IOKit
  - IOSurface
  - Kernel
  - kext tools
  - libarchive
  - LibreSSL
  - OpenLDAP
  - OpenPAM
  - OpenSSL
  - Power Management
  - Security
  - syslog
  - WiFi
  - xar

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

Furthermore, CVE-2016-6304, CVE-2016-7596, and CVE-2016-7604 also affect Mac OS X versions 10.10.5 and 10.11.6. However, this plugin does not check those versions.

Curl 安全性團隊報告：

CVE-2016-5419 - TLS 工作階段恢復用戶端憑證繞過

CVE-2016-5420 - 以錯誤的用戶端憑證重複使用連線

CVE-2016-5421 - 釋放後使用連線結構

- 修正以錯誤用戶端憑證重複使用連線的問題 (CVE-2016-5420)

- 修正 TLS 工作階段恢復用戶端憑證繞過問題 (CVE-2016-5419)

- 修正釋放後使用連線結構的問題 (CVE-2016-5421)

請注意，Tenable Network Security 已直接從 Fedora 更新系統網站擷取前置描述區塊。
Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

當用戶端憑證已變更時，curl 和 7.50.1 版之前的 libcurl 並未防止 TLS 工作階段恢復，導致遠端攻擊者可藉由恢復工作階段繞過預定的限制。(CVE-2016-5419)

當選擇要重新使用的 TLS 連線時，curl 和 7.50.1 版之前的 libcurl 並未檢查用戶端憑證，這可能允許遠端攻擊者藉著利用先前使用不同用戶端憑證建立的連線，劫持連線的驗證。
(CVE-2016-5420)

7.50.1 版之前的 libcurl 允許攻擊者控制要使用哪一個連線，或可能透過未知向量而有其他不明影響。
(CVE-2016-5421)

此 curl 更新可修正下列問題：

- 修正 FTP 的一個效能迴歸 (boo#991746)

- TLS 工作階段恢復用戶端憑證繞過 (boo#991389、CVE-2016-5419)

- 以錯誤的用戶端憑證重新使用連線 (boo#991390、CVE-2016-5420)

- 釋放後使用連線結構 (boo#991391、CVE-2016-5421)

遠端主機執行的 macOS 是 10.12.2 之前的 10.12.x 版。因此受到下列元件中的多個弱點影響：- apache_mod_php - AppleGraphicsPowerManagement - Assets - Audio - Bluetooth - CoreCapture - CoreFoundation - CoreGraphics - CoreMedia External Displays - CoreMedia Playback - CoreStorage - CoreText - curl - Directory Services - Disk Images - FontParser - Foundation - Grapher - ICU - ImageIO - Intel Graphics Driver - IOFireWireFamily - IOAcceleratorFamily - IOHIDFamily - IOKit - IOSurface - Kernel - kext tools - libarchive - LibreSSL - OpenLDAP - OpenPAM - OpenSSL - Power Management - Security - syslog - WiFi - xar 請注意，如果成功惡意利用多數嚴重問題，將導致任意程式碼執行。此外，CVE-2016-6304、CVE-2016-7596 和 CVE-2016-7604 也會影響 Mac OS X 10.10.5 和 10.11.6 版。不過，此外掛程式並未檢查這些版本。

遠端主機上安裝的 Tenable Log Correlation Engine (LCE) 版本比 4.8.1 舊。因此，會受到以下弱點影響：- Handlebars 程式庫的 lib/handlebars/utils.js 指令碼中，有多個跨網站指令碼 (XSS) 弱點存在，這是因為將取消引用的屬性傳送至範本時，未正確逸出輸入所致。未經驗證的遠端攻擊者可惡意利用這些弱點，透過特製要求在使用者的瀏覽器工作階段內執行任意指令碼。(CVE-2015-8861、CVE-2015-8862) - Perl-Compatible Regular Expressions (PCRE) 元件中有堆積型緩衝區溢位情形存在，會在處理重複命名群組中的巢狀向後參照時遭到觸發。未經驗證的遠端攻擊者可加以惡意利用，藉此引發拒絕服務情形或執行任意程式碼。(CVE-2016-1283) - 在 libxml2 元件的 parserInternals.c 中有一個超出邊界讀取錯誤存在，這是因為不當剖析 XML 檔案中的字元所致。未經驗證的遠端攻擊者可惡意利用此弱點，洩露敏感資訊或造成拒絕服務情形。(CVE-2016-1833) - 在 libxml2 元件的 xmlstring.c 中有溢位情形存在，這是因為在處理含有 NULL 的字串時，不當驗證使用者提供的輸入所致。未經驗證的遠端攻擊者可惡意利用此問題，透過特製的檔案，造成拒絕服務情形，或是執行任意程式碼。(CVE-2016-1834) - 在 libxml2 元件的 parser.c 中有多個釋放後使用錯誤存在，會在剖析複雜名稱時遭到觸發。未經驗證的遠端攻擊者可加以惡意利用，透過特製的檔案解除參照已釋放的記憶體，甚或執行任意程式碼。(CVE-2016-1835, CVE-2016-1836) - 在 libxml2 元件的 HTMLparser.c 及 xmlregexp.c 中有多個堆積型緩衝區溢位情形存在，這是因為剖析某個範圍內的字元時，不當驗證使用者提供的輸入所致。未經驗證的遠端攻擊者可利用這些問題，透過特製的網頁，引發拒絕服務情形，或是執行任意程式碼。(CVE-2016-1837、CVE-2016-1839、CVE-2016-1840) - 在 libxml2 元件的 parser.c 的 中有多個超出邊界讀取錯誤存在。未經驗證的遠端攻擊者可惡意利用這些問題，以洩露敏感資訊或造成拒絕服務情形。(CVE-2016-1838、CVE-2016-4447) - 在 OpenSSL 元件中，檔案 crypto/evp/encode.c 內的 EVP_EncodeUpdate() 函式內有堆積緩衝區溢位情形存在，會在處理大量輸入資料時遭到觸發。未經驗證的遠端攻擊者可加以惡意利用，進而引發拒絕服務情形。(CVE-2016-2105) - OpenSSL 元件中 crypto/evp/evp_enc.c 檔案內的 EVP_EncryptUpdate() 函式中存在堆積緩衝區溢位情形，含有部分區塊的相同函式發生上一次呼叫後，會在處理大量輸入資料時遭到觸發。未經驗證的遠端攻擊者可加以惡意利用，進而引發拒絕服務情形。(CVE-2016-2106) - crypto/evp/e_aes_cbc_hmac_sha1.c 檔案中的 aesni_cbc_hmac_sha1_cipher() 函式和 crypto/evp/e_aes_cbc_hmac_sha256.c 檔案中的 aesni_cbc_hmac_sha256_cipher() 函式有多個缺陷存在，連線使用伺服器支援的 AES-CBC 密碼和 AES-NI 時，會觸發這些缺陷。攔截式攻擊者可惡意利用這些弱點，發動 padding oracle 攻擊，進而解密網路流量。(CVE-2016-2107) - 在 OpenSSL 元件中，ASN.1 編碼器有一個遠端程式碼執行弱點存在，此弱點是因為嘗試編碼以負整數表示的零值時，發生反向溢位情形所致。未經驗證的遠端攻擊者可惡意利用此弱點損毀記憶體，進而導致任意程式碼執行。(CVE-2016-2108) - d2i BIO 函式從 BIO 讀取 ASN.1 資料時存在多個不明缺陷，這是因為無效編碼造成配置大量記憶體所致。未經驗證的遠端攻擊者可惡意利用這些缺陷，透過資源耗盡造成拒絕服務情形。(CVE-2016-2109) - 檔案 crypto/x509/x509_obj.c 的 X509_NAME_oneline() 函式處理極長的 ASN1 字串時，有一個超出邊界讀取錯誤存在。未經驗證的遠端攻擊者可加以惡意利用洩露堆疊記憶體的內容。(CVE-2016-2176) - Perl-Compatible Regular Expressions (PCRE) 元件中有溢位情形存在，這是因為在處理 (*ACCEPT) 動詞命令時，不當驗證使用者提供的輸入所致。未經驗證的遠端攻擊者可加以惡意利用，藉此引發拒絕服務情形或執行任意程式碼。(CVE-2016-3191) - 以復原模式處理 XML 內容時，libxml2 元件的 parser.c 中有一個缺陷存在。未經驗證的遠端攻擊者可加以惡意利用，造成堆疊耗盡，進而導致拒絕服務情形。(CVE-2016-3627) - libxml2 元件的 parser.c 中有一個缺陷存在，這是因為不當驗證使用者提供的輸入所致。未經驗證的遠端攻擊者可加以惡意利用，造成堆疊耗盡，進而導致拒絕服務情形。(CVE-2016-3705) - libxml2 元件中有一個格式字串缺陷存在，這是因為不當使用字串格式指定名稱 (例如，%s 和 %x) 所致。未經驗證的遠端攻擊者可加以惡意利用，藉此引發拒絕服務情形或執行任意程式碼。(CVE-2016-4448) - parser.c 中有一個 XML 外部實體插入弱點存在，這是因為不當剖析 XML 資料所致。未經驗證的遠端攻擊者可加以惡意利用，透過特製 XML 資料洩露任意檔案，或是造成拒絕服務情形。(CVE-2016-4449) - 以復原模式處理 XML 內容時，libxml2 的 xmlsave.c 元件中有一個超出邊界讀取錯誤存在。未經驗證的遠端攻擊者可惡意利用此弱點，洩露敏感資訊或造成拒絕服務情形。(CVE-2016-4483) - libcurl 元件中有一個安全性繞過弱點存在，這是因為即使用戶端憑證失敗，程式還是會嘗試恢復 TLS 工作階段所致。未經驗證的遠端攻擊者可加以惡意利用，繞過驗證機制。(CVE-2016-5419) - libcurl 元件中有一個資訊洩露弱點存在，這是因為程式重複使用具有不同用戶端憑證的 TLS 連線所致。未經驗證的遠端攻擊者可惡意利用此弱點洩露敏感的跨領域資訊。(CVE-2016-5420) - libcurl 元件中有一個釋放後使用錯誤存在，會在未正確清除連線指標以便處理時遭到觸發。未經驗證的遠端攻擊者可加以惡意利用，解除參照已釋放的記憶體，進而可能導致執行任意程式碼。(CVE-2016-5421) - 有多個已儲存跨網站指令碼 (XSS) 弱點存在，這是因不當驗證使用者提供的輸入所致。經驗證的遠端攻擊者可加以惡意利用，透過特製的要求，在使用者的瀏覽器工作階段中執行任意指令碼。(CVE-2016-9261)

Versions of cURL and libcurl prior to 7.50.1 are affected by multiple vulnerabilities :

 - A flaw exists in 'lib/vtls/vtls.c' due to the program attempting to resume TLS sessions even if the client certificate fails. This may allow a context-dependent attacker to bypass validation mechanisms. (CVE-2016-5419)
 - A use-after-free error exists in the 'close_all_connections()' function in 'lib/multi.c'. The issue is triggered as connection pointers are not properly cleared for easy handles. This may allow a context-dependent attacker to dereference already freed memory and have an unspecified impact that may potentially include code execution. (CVE-2016-5421)

ID	名前	製品	ファミリー	公開日	更新日	深刻度
93008	Amazon Linux AMI : curl (ALAS-2016-730)	Nessus	Amazon Linux Local Security Checks	2016/8/18	2020/5/11	high
93334	openSUSE Security Update : curl (openSUSE-2016-1043)	Nessus	SuSE Local Security Checks	2016/9/6	2021/1/19	high
97893	Tenable Log Correlation Engine (LCE) < 4.8.1 Multiple Vulnerabilities	Nessus	Misc.	2017/3/22	2021/10/25	critical
206854	NewStart CGSL MAIN 6.02 : curl Multiple Vulnerabilities (NS-SA-2024-0050)	Nessus	NewStart CGSL Local Security Checks	2024/9/10	2024/9/10	critical
95917	macOS 10.12.x < 10.12.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2016/12/16	2020/1/7	high
92742	FreeBSD：Curl 中的弱點 (e4bc70fc-5a2f-11e6-a1bc-589cfc0654e1)	Nessus	FreeBSD Local Security Checks	2016/8/5	2021/1/4	high
92990	Fedora 23：curl (2016-8354baae0f)	Nessus	Fedora Local Security Checks	2016/8/17	2021/1/11	high
93008	Amazon Linux AMI：curl (ALAS-2016-730)	Nessus	Amazon Linux Local Security Checks	2016/8/18	2020/5/11	high
93334	openSUSE 安全性更新：curl (openSUSE-2016-1043)	Nessus	SuSE Local Security Checks	2016/9/6	2021/1/19	high
95917	macOS 10.12.x < 10.12.2 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	2016/12/16	2020/1/7	high
97893	Tenable Log Correlation Engine (LCE) < 4.8.1 Multiple Vulnerabilities	Nessus	Misc.	2017/3/22	2021/10/25	critical
9764	cURL/libcurl 7.x < 7.50.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	2016/11/11	2019/3/6	high

検出

プラグインの検索

high

high

critical

critical

high

high

high

high

high

high

critical

high