GLSA-201203-02 : cURL: Multiple vulnerabilities (BEAST)

2012-03-06T00:00:00
ID GENTOO_GLSA-201203-02.NASL
Type nessus
Reporter Tenable
Modified 2018-07-11T00:00:00

Description

The remote host is affected by the vulnerability described in GLSA-201203-02 (cURL: Multiple vulnerabilities)

Multiple vulnerabilities have been found in cURL:
  When zlib is enabled, the amount of data sent to an application for         automatic decompression is not restricted (CVE-2010-0734).
  When performing GSSAPI authentication, credential delegation is         always used (CVE-2011-2192).
  When SSL is enabled, cURL improperly disables the OpenSSL workaround         to mitigate an information disclosure vulnerability in the SSL and TLS         protocols (CVE-2011-3389).
  libcurl does not properly verify file paths for escape control         characters in IMAP, POP3 or SMTP URLs (CVE-2012-0036).

Impact :

A remote attacker could entice a user or automated process to open a       specially crafted file or URL using cURL, possibly resulting in the       remote execution of arbitrary code, a Denial of Service condition,       disclosure of sensitive information, or unwanted actions performed via       the IMAP, POP3 or SMTP protocols. Furthermore, remote servers may be able       to impersonate clients via GSSAPI requests.

Workaround :

There is no known workaround at this time.

                                        
                                            #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201203-02.
#
# The advisory text is Copyright (C) 2001-2016 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(58212);
  script_version("1.12");
  script_cvs_date("Date: 2018/07/11 17:09:26");

  script_cve_id("CVE-2010-0734", "CVE-2011-2192", "CVE-2011-3389", "CVE-2012-0036");
  script_bugtraq_id(38162, 48434, 49778, 51665);
  script_xref(name:"GLSA", value:"201203-02");

  script_name(english:"GLSA-201203-02 : cURL: Multiple vulnerabilities (BEAST)");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201203-02
(cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been found in cURL:
      When zlib is enabled, the amount of data sent to an application for
        automatic decompression is not restricted (CVE-2010-0734).
      When performing GSSAPI authentication, credential delegation is
        always used (CVE-2011-2192).
      When SSL is enabled, cURL improperly disables the OpenSSL workaround
        to mitigate an information disclosure vulnerability in the SSL and TLS
        protocols (CVE-2011-3389).
      libcurl does not properly verify file paths for escape control
        characters in IMAP, POP3 or SMTP URLs (CVE-2012-0036).
  
Impact :

    A remote attacker could entice a user or automated process to open a
      specially crafted file or URL using cURL, possibly resulting in the
      remote execution of arbitrary code, a Denial of Service condition,
      disclosure of sensitive information, or unwanted actions performed via
      the IMAP, POP3 or SMTP protocols. Furthermore, remote servers may be able
      to impersonate clients via GSSAPI requests.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201203-02"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All cURL users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=net-misc/curl-7.24.0'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:curl");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"patch_publication_date", value:"2012/03/06");
  script_set_attribute(attribute:"in_the_news", value:"true");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/03/06");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2018 Tenable Network Security, Inc.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"net-misc/curl", unaffected:make_list("ge 7.24.0"), vulnerable:make_list("lt 7.24.0"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
  else security_hole(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "cURL");
}