PT-2006-5299 · Curl · Curl

Published 2006-08-31 · Updated 2008-09-05 · CVE-2006-4499

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions ModernBill versions 5.0.4 and earlier

Description The issue allows remote attackers to read network traffic via a man-in-the-middle (MITM) attack because it uses cURL with insecure settings for CURLOPT SSL VERIFYPEER and CURLOPT SSL VERIFYHOST that do not verify SSL certificates.

Recommendations For ModernBill versions 5.0.4 and earlier, update the cURL settings to enable verification of SSL certificates by setting CURLOPT SSL VERIFYPEER and CURLOPT SSL VERIFYHOST to appropriate values to prevent man-in-the-middle attacks.

Fix

Related Identifiers

CVE-2006-4499

Affected Products

Curl

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2006-4499 · Security Note
• http://secunia.com/advisories/21663 · Note
• http://justinsamuel.com/security-vulnerabilities/12/vulnerability-modernbill-insecure-curl-settings · Note