PT-2012-1100 · Curl+1 · Curl+1
Dan Fandrich
·
Publicado
2012-01-24
·
Atualizado
2018-01-10
·
CVE-2012-0036
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
curl versions prior to 7.24.0
Description
The issue concerns the improper handling of special characters during pathname extraction from URLs, allowing remote attackers to conduct data-injection attacks. This can be exploited through crafted URLs, potentially affecting protocols such as IMAP, POP3, and SMTP. The vulnerability can lead to data injection attacks, including CRLF injection, which may result in unintended actions, such as deleting messages or sending unintended emails.
Recommendations
For versions prior to 7.24.0, update to version 7.24.0 or later to resolve the issue. As a temporary workaround, consider restricting user input for URLs to prevent maliciously crafted URLs from being processed. Additionally, restrict access to vulnerable protocols such as IMAP, POP3, and SMTP until the update is applied.
Correção
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Suse
Curl