printf() 函式中 libcurl 的實作在進行大型浮點輸出時，會觸發緩衝區溢位。在缺少必要輸入篩選的情況下，如果有任何接受外部格式字串的應用程式，則可能會允許遠端攻擊。此缺陷不存在於命令列工具中。

遠端主機執行的 macOS 是 10.12.4 之前的 10.12.x 版。因此會受到多個元件中的多個弱點影響，其中有些是遠端程式碼執行弱點。未經驗證的遠端攻擊者可惡意利用這些遠端程式碼執行弱點，誘騙使用者造訪特製的網站，進而導致在目前使用者的內容中執行任意程式碼。受影響的元件如下：- apache - apache_mod_php - AppleGraphicsPowerManagement - AppleRAID - Audio - Bluetooth - Carbon - CoreGraphics - CoreMedia - CoreText - curl - EFI - FinderKit - FontParser - HTTPProtocol - Hypervisor - iBooks - ImageIO - Intel Graphics Driver - IOATAFamily - IOFireWireAVC - IOFireWireFamily - Kernel - Keyboards - libarchive - libc++abi - LibreSSL - MCX Client - Menus - Multi-Touch - OpenSSH - OpenSSL - Printing - python - QuickTime - Security - SecurityFoundation - sudo - System Integrity Protection - tcpdump - tiffutil - WebKit

遠端 Redhat Enterprise Linux 6 / 7 主機上安裝的套件受到 RHSA-2018:3558 公告中提及的多個弱點影響。

  - curl：TLS 工作階段恢復用戶端憑證繞過 (CVE-2016-5419)

  - curl：以錯誤用戶端憑證重複使用連線 (CVE-2016-5420)

  - curl：釋放後使用連線結構 (CVE-2016-5421)

  - curl：用戶端憑證重複使用錯誤 (CVE-2016-7141)

  - curl：逸出和未逸出整數溢位 (CVE-2016-7167)

  - curl：其他伺服器的 Cookie 插入 (CVE-2016-8615)

  - curl：不區分大小寫的密碼比較 (CVE-2016-8616)

  - curl：透過未經檢查的乘法發生超出邊界寫入 (CVE-2016-8617)

  - curl：curl_maprintf 中發生雙重釋放 (CVE-2016-8618)

  - curl：krb5 程式碼中發生雙重釋放 (CVE-2016-8619)

  - curl：Glob 剖析器寫入/讀取超出邊界 (CVE-2016-8620)

  - curl：curl_getdate 超出邊界讀取 (CVE-2016-8621)

  - curl：透過整數截斷的 URL 未逸出堆積溢位 (CVE-2016-8622)

  - curl：透過共用 cookie 發生釋放後使用 (CVE-2016-8623)

  - curl：具有 '#' 的 URL 剖析無效 (CVE-2016-8624)

  - curl：IDNA 2003 使得 curl 使用錯誤的主機 (CVE-2016-8625)

  - curl：printf 浮點緩衝區溢位 (CVE-2016-9586)

  - curl：--write-out 超出邊界讀取 (CVE-2017-7407)

  - curl：透過整數溢位的 NTLM 緩衝區溢位 (CVE-2017-8816)

  - curl：FTP 萬用字元超出邊界讀取 (CVE-2017-8817)

  - httpd：在 mod_authnz_ldap 中使用太小的 Accept-Language 值時，就會發生越界寫入 (CVE-2017-15710)

  - httpd：<FilesMatch> 在檔案名稱中發生結尾新行繞過 (CVE-2017-15715)

  - curl：TFTP 傳送超過緩衝區大小 (CVE-2017-1000100)

  - curl：URL 通配符超出邊界讀取 (CVE-2017-1000101)

  - curl：FTP PWD 回應剖析器超出邊界讀取 (CVE-2017-1000254)

  - curl：IMAP FETCH 回應超出邊界讀取 (CVE-2017-1000257)

  - httpd：在 mod_session 中不當處理標頭可讓遠端使用者修改 CGI 應用程式的工作階段資料 (CVE-2018-1283)

  - httpd：讀取 HTTP 要求失敗後造成越界存取 (CVE-2018-1301)

  - httpd：mod_cache_socache 中的超出邊界讀取問題可讓遠端攻擊者造成拒絕服務 (CVE-2018-1303)

  - httpd：在 mod_auth_digest 中產生弱式摘要驗證 nonce (CVE-2018-1312)

  - httpd：mod_http2: 配置給工作者過多時間，可能導致 DoS (CVE-2018-1333)

  - httpd：藉由傳送持續的 SETTINGS 造成 HTTP/2 連線 DoS (CVE-2018-11763)

  - curl：透過整數溢位的 NTLM 密碼溢位 (CVE-2018-14618)

  - curl：重新導向時洩露 HTTP 身份驗證 (CVE-2018-1000007)

  - curl：FTP 路徑欺騙導致 NIL 位元組越界寫入 (CVE-2018-1000120)

  - curl：LDAP NULL 指標解除參照 (CVE-2018-1000121)

  - curl：RTSP RTP 緩衝區過度讀取 (CVE-2018-1000122)

  - curl：遺漏 RTSP 標頭時發生超出邊界堆積讀取，進而導致資訊洩露或拒絕服務 (CVE-2018-1000301)

請注意，Nessus 並未測試這些問題，而是僅根據應用程式自我報告的版本號碼作出判斷。

The remote host is running a version of Mac OS X version 10.x prior to 10.12.6, and is affected by multiple vulnerabilities :

 - An overflow condition exists in the curl component in the 'dprintf_formatf()' function that is triggered when handling floating point conversion. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2016-9586)
 - A flaw exits in the curl component in the 'randit()' function within file lib/rand.c due to improper initialization of the 32-bit random value, which is used, for example, to generate Digest and NTLM authentication nonces, resulting in weaker cryptographic operations than expected. (CVE-2016-9594)
 - A flaw exists in the curl component in the 'allocate_conn()' function in lib/url.c when using the OCSP stapling feature for checking a X.509 certificate revocation status. The issue is triggered as the request option for OCSP stapling is not properly passed to the TLS library, resulting in no error being returned even when no proof of the validity of the certificate could be provided. A man-in-the-middle attacker can exploit this to provide a revoked certificate. (CVE-2017-2629)
 - A remote code execution vulnerability exists in the CoreAudio component due to improper validation of user-supplied input when handling movie files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted movie file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7008)
 - A memory corruption issue exists in the IOUSBFamily component due to improper validation of user-supplied input. A local attacker can exploit this, via a specially crafted application, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7009)
 - Multiple out-of-bounds read errors exist in the libxml2 component due to improper handling of specially crafted XML documents. An unauthenticated, remote attacker can exploit these to disclose user information. (CVE-2017-7010, CVE-2017-7013)
 - Multiple memory corruption issues exist in the Intel Graphics Driver component due to improper validation of input. A local attacker can exploit these issues to execute arbitrary code with elevated privileges. (CVE-2017-7014, CVE-2017-7017, CVE-2017-7035, CVE-2017-7044)
 - A remote code execution vulnerability exists in the Audio component due to improper validation of user-supplied input when handling audio files. An unauthenticated, remote attacker can exploit this, by convincing a user to play a specially crafted audio file, to execute arbitrary code. (CVE-2017-7015)
 - Multiple remote code execution vulnerabilities exist in the afclip component due to improper validation of user-supplied input when handling audio files. An unauthenticated, remote attacker can exploit these vulnerabilities, by convincing a user to play a specially crafted audio file, to execute arbitrary code. (CVE-2017-7016, CVE-2017-7033)
 - A memory corruption issue exists in the AppleGraphicsPowerManagement component due to improper validation of input. A local attacker can exploit this to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7021)
 - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7022, CVE-2017-7024, CVE-2017-7026)
 - Multiple memory corruption issues exist in the kernel due to improper validation of input. A local attacker can exploit these issues to cause a denial of service condition or the execution of arbitrary code with kernel privileges. (CVE-2017-7023, CVE-2017-7025, CVE-2017-7027, CVE-2017-7069)
 - Multiple unspecified flaws exist in the kernel due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory contents. (CVE-2017-7028, CVE-2017-7029, CVE-2017-7067)
 - A flaw exists in the Foundation component due to improper validation of input. A unauthenticated, remote attacker can exploit this, by convincing a user to open specially crafted file, to execute arbitrary code. (CVE-2017-7031)
 - A memory corruption issue exists in the 'kext tools' component due to improper validation of input. A local attacker can exploit this to execute arbitrary code with elevated privileges. (CVE-2017-7032)
 - Multiple unspecified flaws exist in the Intel Graphics Driver component due to a failure to properly sanitize input. A local attacker can exploit these issues, via a specially crafted application, to disclose restricted memory contents. (CVE-2017-7036, CVE-2017-7045)
 - A memory corruption issue exists in the libxpc component due to improper validation of input. A local attacker can exploit this issue, via a specifically crafted application, to cause a denial of service condition or the execution of arbitrary code with system privileges. (CVE-2017-7047)
 - Multiple memory corruption issues exist in the Bluetooth component due to improper validation of input. A local attacker can exploit these issues to execute arbitrary code with system privileges. (CVE-2017-7050, CVE-2017-7051)
 - A memory corruption issue exists in the Bluetooth component due to improper validation of input. A local attacker can exploit these issues to execute arbitrary code with system privileges. (CVE-2017-7054)
 - A buffer overflow condition exists in the Contacts component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7062)
 - A buffer overflow condition exists in the libarchive component due to improper validation of user-supplied input. An unauthenticated, remote attacker can exploit this, via a specially crafted archive file, to cause a denial of service condition or the execution of arbitrary code. (CVE-2017-7068)
 - A certificate validation bypass vulnerability exists in the curl component due to the program attempting to resume TLS sessions even if the client certificate fails. An unauthenticated, remote attacker can exploit this to bypass validation mechanisms. (CVE-2017-7468)
 - A memory corruption issue exists in the Broadcom BCM43xx family Wi-Fi Chips component that allows an unauthenticated, remote attacker to execute arbitrary code. (CVE-2017-9417)


ID	名稱	產品	系列	已發布	已更新	嚴重性
97896	Amazon Linux AMI：curl (ALAS-2017-806)	Nessus	Amazon Linux Local Security Checks	2017/3/23	2018/8/31	high
99134	macOS 10.12.x < 10.12.4 Multiple Vulnerabilities (httpoxy)	Nessus	MacOS X Local Security Checks	2017/3/31	2019/11/13	critical
194113	RHEL 6 / 7：httpd24 (RHSA-2018:3558)	Nessus	Red Hat Local Security Checks	2024/4/27	2024/4/27	critical
700170	Mac OS X 10.x < 10.12.6 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	2017/7/27	2019/3/6	critical

偵測

搜尋 Plugin

high

critical

critical

critical