PT-2016-5688 · Arm+3 · Mbed Tls+4
Moti Avrahami
·
Publicado
2014-06-06
·
Atualizado
2024-05-01
·
CVE-2016-3739
CVSS v3.1
5.3
Média
| Vetor | AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
cURL and libcurl versions prior to 7.49.0
Description
The issue allows remote attackers to spoof servers via an arbitrary valid certificate when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address. This occurs because libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, or when explicitly asked to use SSLv3. The flaw exists when libcurl is built to use mbedTLS or PolarSSL as the TLS backend. By tricking a libcurl-using client to use a URL with a host specified as IP address only, an application could be made to connect to an impostor server or Man In The Middle host without noticing.
Recommendations
For versions prior to 7.49.0, update to version 7.49.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of IP addresses as hostnames and disabling SSLv3 to minimize the risk of exploitation. Restrict access to TLS oriented protocols such as HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc., when using IP addresses or SSLv3, until the issue is resolved.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Polarssl
Curl
Libcurl
Mbed Tls