PT-2016-7888 · Curl · Libcurl

Dan Mcnulty · Publicado 2016-12-21 · Atualizado 2024-08-01 · CVE-2016-9952

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libcurl versions 7.30.0 through 7.51.0

Description The issue arises from a flaw in the verify certificate function when comparing a wildcard certificate name to the hostname used for the connection. This flaw allows remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, such as a DNS name of *.com. The comparison process removes the wildcard character from the cert name and checks if the connection hostname ends with the modified cert name, which could lead to matches like example.com with a DNS SAN of *.com. This approach violates recommendations in RFC 6125.

Recommendations For libcurl versions 7.30.0 through 7.51.0, consider disabling the verify certificate function until a patch is available, or restrict the use of wildcard certificates to minimize the risk of exploitation. Avoid using overly permissive wildcard SANs in server certificates.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2016-9952

Produtos afetados

Libcurl

Referências · 9

• https://t.me/cvenotify/63799 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2016-9952 · Aviso do Fabricante
• https://t.me/cvenotify/63798 · Publicação no Telegram
• https://curl.haxx.se/CVE-2016-9952.patch · Aviso do Fabricante
• https://osv.dev/vulnerability/CURL-CVE-2016-9952 · Aviso do Fabricante
• https://curl.haxx.se/docs/adv_20161221B.html · Aviso do Fabricante
• https://security.alpinelinux.org/vuln/CVE-2016-9952 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9952 · Nota de Segurança
• https://osv.dev/vulnerability/ALPINE-CVE-2016-9952 · Aviso do Fabricante