PT-2006-5299 · Curl · Curl

Publicado 2006-08-31 · Atualizado 2008-09-05 · CVE-2006-4499

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ModernBill versions 5.0.4 and earlier

Description The issue allows remote attackers to read network traffic via a man-in-the-middle (MITM) attack because it uses cURL with insecure settings for CURLOPT SSL VERIFYPEER and CURLOPT SSL VERIFYHOST that do not verify SSL certificates.

Recommendations For ModernBill versions 5.0.4 and earlier, update the cURL settings to enable verification of SSL certificates by setting CURLOPT SSL VERIFYPEER and CURLOPT SSL VERIFYHOST to appropriate values to prevent man-in-the-middle attacks.

Correção

Identificadores relacionados

CVE-2006-4499

Produtos afetados

Curl

Referências · 3

• http://secunia.com/advisories/21663 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4499 · Nota de Segurança
• http://justinsamuel.com/security-vulnerabilities/12/vulnerability-modernbill-insecure-curl-settings · Nota