PT-2013-1240 · Curl+1 · Libcurl+2
Publicado
2013-12-17
·
Atualizado
2016-04-07
·
CVE-2013-6422
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
libcurl versions 7.21.4 through 7.33.0
curl versions prior to 7.34.0
Description
The issue allows remote attackers to conduct man-in-the-middle (MITM) attacks, making it easier to spoof servers. This is due to the disabling of the
CURLOPT SSL VERIFYHOST check for CN or SAN host name fields when digital signature verification (CURLOPT SSL VERIFYPEER) is disabled. The vulnerability can lead to a breach of confidentiality, integrity, and availability of protected information. Exploitation can be done remotely.Recommendations
For libcurl versions 7.21.4 through 7.33.0, update to version 7.34.0 or later to resolve the issue.
For curl versions prior to 7.34.0, update to version 7.34.0 or later to resolve the issue.
As a temporary workaround, consider enabling
CURLOPT SSL VERIFYPEER to mitigate the risk of exploitation.Correção
RCE
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Curl
Libcurl