PT-2016-7888 · Curl · Libcurl

Dan Mcnulty · Published 2016-12-21 · Updated 2024-08-01 · CVE-2016-9952

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libcurl versions 7.30.0 through 7.51.0

Description The issue arises from a flaw in the verify certificate function when comparing a wildcard certificate name to the hostname used for the connection. This flaw allows remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, such as a DNS name of *.com. The comparison process removes the wildcard character from the cert name and checks if the connection hostname ends with the modified cert name, which could lead to matches like example.com with a DNS SAN of *.com. This approach violates recommendations in RFC 6125.

Recommendations For libcurl versions 7.30.0 through 7.51.0, consider disabling the verify certificate function until a patch is available, or restrict the use of wildcard certificates to minimize the risk of exploitation. Avoid using overly permissive wildcard SANs in server certificates.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2016-9952

Affected Products

Libcurl

References · 9

• https://osv.dev/vulnerability/CVE-2016-9952 · Vendor Advisory
• https://curl.haxx.se/CVE-2016-9952.patch · Vendor Advisory
• https://osv.dev/vulnerability/CURL-CVE-2016-9952 · Vendor Advisory
• https://curl.haxx.se/docs/adv_20161221B.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-9952 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2016-9952 · Vendor Advisory
• https://t.me/cvenotify/63799 · Telegram Post
• https://t.me/cvenotify/63798 · Telegram Post
• https://security.alpinelinux.org/vuln/CVE-2016-9952 · Note