PT-2016-5688 · Arm+3 · Mbed Tls+4

Moti Avrahami · Published 2014-06-06 · Updated 2024-05-01 · CVE-2016-3739

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions cURL and libcurl versions prior to 7.49.0

Description The issue allows remote attackers to spoof servers via an arbitrary valid certificate when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address. This occurs because libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, or when explicitly asked to use SSLv3. The flaw exists when libcurl is built to use mbedTLS or PolarSSL as the TLS backend. By tricking a libcurl-using client to use a URL with a host specified as IP address only, an application could be made to connect to an impostor server or Man In The Middle host without noticing.

Recommendations For versions prior to 7.49.0, update to version 7.49.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of IP addresses as hostnames and disabling SSLv3 to minimize the risk of exploitation. Restrict access to TLS oriented protocols such as HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc., when using IP addresses or SSLv3, until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

CWE-297

Related Identifiers

ALT-PU-2014-1748

ALT-PU-2016-1225

ALT-PU-2016-1536

CVE-2016-3739

Affected Products

Alt Linux

Polarssl

Curl

Libcurl

Mbed Tls

References · 17

• http://slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.495349 · Vendor Advisory
• https://curl.haxx.se/CVE-2016-3739.patch · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3739 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-3739 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3739 · Security Note
• https://security.gentoo.org/glsa/201701-47 · Vendor Advisory
• https://curl.haxx.se/docs/adv_20160518.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-3739 · Vendor Advisory
• https://osv.dev/vulnerability/CURL-CVE-2016-3739 · Vendor Advisory
• http://securitytracker.com/id/1035907 · Note
• http://securityfocus.com/bid/90726 · Note
• http://oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html · Note
• https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05390722 · Note
• https://t.me/cvenotify/78715 · Telegram Post
• https://curl.haxx.se/changes.html#7_49_0 · Note