PT-2014-4760 · Curl · Libcurl

Published 2014-03-26 · Updated 2017-04-29 · CVE-2014-2522

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions libcurl versions 7.27.0 through 7.35.0

Description The issue arises when libcurl, built to use the SChannel/Winssl TLS backend on Windows, fails to verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This occurs when accessing a URL that uses a numerical IP address, allowing man-in-the-middle attackers to spoof servers via an arbitrary valid certificate. The problem is specific to libcurl using the Schannel TLS backend, which is the native library provided by Microsoft Windows, and only affects users on Windows.

Recommendations For libcurl versions 7.27.0 through 7.35.0, consider disabling the use of the SChannel/Winssl TLS backend until a patch is available, or restrict access to URLs using numerical IP addresses to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-297

Related Identifiers

CVE-2014-2522

Affected Products

Libcurl

References · 14

• http://secunia.com/advisories/57966 · Vendor Advisory
• http://secunia.com/advisories/57836 · Vendor Advisory
• http://curl.haxx.se/docs/adv_20140326D.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-2522 · Security Note
• http://secunia.com/advisories/57968 · Vendor Advisory
• https://osv.dev/vulnerability/CURL-CVE-2014-2522 · Vendor Advisory
• http://secunia.com/advisories/59458 · Note
• http://seclists.org/oss-sec/2014/q1/585 · Note
• http://getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release · Note
• http://getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release · Note
• http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862 · Note
• http://getchef.com/blog/2014/04/09/chef-server-11-0-12-release · Note
• http://securityfocus.com/bid/66296 · Note
• http://seclists.org/oss-sec/2014/q1/586 · Note