PT-2007-1008 · Curl+1 · Libcurl+1

Published 2007-07-10 · Updated 2017-07-29 · CVE-2007-3564

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: libcurl versions 7.14.0 through 7.16.3

Description: The issue allows remote attackers to bypass certain access restrictions by not checking SSL/TLS certificate expiration or activation dates when libcurl is built with GnuTLS support. This flaw enables malicious servers to present certificates that were not rejected properly, although CA certificate and common name checks are still in place, reducing the risk for random servers to exploit this flaw. The exploitation of this vulnerability may lead to a violation of confidentiality, integrity, and availability of protected information.

Recommendations: For libcurl versions 7.14.0 through 7.16.3, consider updating to a version that includes the fix for this issue, as the current version does not properly verify certificate expiration or activation dates when built with GnuTLS support. As a temporary workaround, consider restricting access to sensitive resources that rely on libcurl for SSL/TLS connections until a patched version is available.

Fix

Weakness Enumeration

CWE-298

Related Identifiers

BDU:2015-01766

CVE-2007-3564

DSA-1333-1

Affected Products

Gnutls

Libcurl

References · 19

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3564 · Security Note
• https://osv.dev/vulnerability/CVE-2007-3564 · Vendor Advisory
• http://curl.haxx.se/docs/adv_20070710.html · Vendor Advisory
• https://osv.dev/vulnerability/CURL-CVE-2007-3564 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-01766 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2007-3564 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3564 · Security Note
• http://debian.org/security/2007/dsa-1333 · Vendor Advisory
• http://secunia.com/advisories/26104 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-3564 · Vendor Advisory
• http://secunia.com/advisories/26108 · Vendor Advisory
• http://trustix.org/errata/2007/0023 · Vendor Advisory
• http://securityfocus.com/bid/24938 · Note
• http://ubuntu.com/usn/usn-484-1 · Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35479 · Note