According to the web server's banner, the version of HP System Management Homepage (SMH) hosted on the remote web server is prior to 7.2.6. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities, in several components and third-party libraries :

  - HP SMH (XSRF)
    - libcurl
    - OpenSSL

Updated lftp packages fix security vulnerability :

lftp incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or just fool users into believing that it is a legitimate site (CVE-2014-0139).

lftp was affected by this issue as it uses code from cURL for checking SSL certificates. The curl package was fixed in MDVSA-2015:098.

- Update to 7.37.0

    - Fixes CVE-2014-0138 and CVE-2014-0139 (RHBZ #1080880)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host has a version of IBM Rational ClearQuest 7.1.x prior to 7.1.2.16 / 8.0.0.x prior to 8.0.0.13 / 8.0.1.x prior to 8.0.1.6 installed. It is, therefore, potentially affected by multiple vulnerabilities in third party libraries :

  - An error exists in the libcURL and OpenSSL libraries     related to an IP address that uses a wildcard in the     subject's Common Name (CN) field of an X.509     certificate. A man-in-the-middle attacker can exploit     this issue to spoof SSL servers. (CVE-2014-0139)

  - An error exists in the OpenSSL library related to     'ec point format extension' handling and multithreaded     clients that allows freed memory to be overwritten     during a resumed session. (CVE-2014-3509)  
  - An error exists in the OpenSSL library related to     handling fragmented 'ClientHello' messages that allow a     man-in-the-middle attacker to force usage of TLS 1.0     regardless of higher protocol levels being supported by     both the server and the client. (CVE-2014-3511)

  - A man-in-the-middle (MitM) information disclosure     vulnerability known as POODLE. The vulnerability is due     to the way SSL 3.0 handles padding bytes when decrypting     messages encrypted using block ciphers in cipher block     chaining (CBC) mode. MitM attackers can decrypt a     selected byte of a cipher text in as few as 256 tries if     they are able to force a victim application to     repeatedly send the same data over newly created SSL 3.0     connections. (CVE-2014-3566)

  - An information disclosure flaw exists in the Java     library within the     'share/classes/sun/security/rsa/RSACore.java' class     related to 'RSA blinding' caused during operations using     private keys and measuring timing differences. This     allows a remote attacker to gain information about used     keys. (CVE-2014-4244)

  - A flaw exists in the Java library within the     'validateDHPublicKey' function in the     'share/classes/sun/security/util/KeyUtil.java' class     which is triggered during the validation of     Diffie-Hellman public key parameters. This allows a     remote attacker to recover a key. (CVE-2014-4263)

  - A NULL pointer dereference error exists in the OpenSSL     library related to handling Secure Remote Password     protocol (SRP) that allows a malicious server to crash a     client, resulting in a denial of service.
    (CVE-2014-5139)

This curl update fixes the following security issues :

  - wrong re-use of connections. (CVE-2014-0138).
    (bnc#868627)

  - IP address wildcard certificate validation.
    (CVE-2014-0139). (bnc#868629)

  - --insecure option inappropriately enforcing security     safeguard. (bnc#870444)

Updated curl packages fix security vulnerabilities :

Paras Sethia discovered that libcurl would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same server, sending requests for one user over the connection authenticated as a different user (CVE-2014-0015).

libcurl can in some circumstances re-use the wrong connection when asked to do transfers using other protocols than HTTP and FTP, causing a transfer that was initiated by an application to wrongfully re-use an existing connection to the same server that was authenticated using different credentials (CVE-2014-0138).

libcurl incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or just fool users into believing that it is a legitimate site (CVE-2014-0139).

New curl packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

This curl update fixes two security issues :

  - bnc#868627: Fixed wrong re-use of connections     (CVE-2014-0138).

  - bnc#868629: Fixed IP address wildcard certificate     validation (CVE-2014-0139).

Updated curl packages fix security vulnerabilities :

Paras Sethia discovered that libcurl would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same server, sending requests for one user over the connection authenticated as a different user (CVE-2014-0015).

libcurl can in some circumstances re-use the wrong connection when asked to do transfers using other protocols than HTTP and FTP, causing a transfer that was initiated by an application to wrongfully re-use an existing connection to the same server that was authenticated using different credentials (CVE-2014-0138).

libcurl incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or just fool users into believing that it is a legitimate site (CVE-2014-0139).

In cURL before 7.38.0, libcurl can be fooled to both sending cookies to wrong sites and into allowing arbitrary sites to set cookies for others. For this problem to trigger, the client application must use the numerical IP address in the URL to access the site (CVE-2014-3613).

In cURL before 7.38.0, libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), thus making them apply broader than cookies are allowed. This can allow arbitrary sites to set cookies that then would get sent to a different and unrelated site or domain (CVE-2014-3620).

Symeon Paraschoudis discovered that the curl_easy_duphandle() function in cURL has a bug that can lead to libcurl eventually sending off sensitive data that was not intended for sending, while performing a HTTP POST operation. This bug requires CURLOPT_COPYPOSTFIELDS and curl_easy_duphandle() to be used in that order, and then the duplicate handle must be used to perform the HTTP POST. The curl command line tool is not affected by this problem as it does not use this sequence (CVE-2014-3707).

When libcurl sends a request to a server via a HTTP proxy, it copies the entire URL into the request and sends if off. If the given URL contains line feeds and carriage returns those will be sent along to the proxy too, which allows the program to for example send a separate HTTP request injected embedded in the URL (CVE-2014-8150).

Two vulnerabilities have been discovered in cURL, an URL transfer library. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2014-0138     Steve Holme discovered that libcurl can in some     circumstances re-use the wrong connection when asked to     do transfers using other protocols than HTTP and FTP.

  - CVE-2014-0139     Richard Moore from Westpoint Ltd. reported that libcurl     does not behave compliant to RFC 2828 under certain     conditions and incorrectly validates wildcard SSL     certificates containing literal IP addresses.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - cURL and libcurl 7.18.0 through 7.32.0, when built with     OpenSSL, disables the certificate CN and SAN name field     verification (CURLOPT_SSL_VERIFYHOST) when the digital     signature verification (CURLOPT_SSL_VERIFYPEER) is     disabled, which allows man-in-the-middle attackers to     spoof SSL servers via an arbitrary valid     certificate.i1/4^CVE-2013-4545i1/4%0

  - The GnuTLS backend in libcurl 7.21.4 through 7.33.0,     when disabling digital signature verification     (CURLOPT_SSL_VERIFYPEER), also disables the     CURLOPT_SSL_VERIFYHOST check for CN or SAN host name     fields, which makes it easier for remote attackers to     spoof servers and conduct man-in-the-middle (MITM)     attacks.i1/4^CVE-2013-6422i1/4%0

  - cURL and libcurl 7.1 before 7.36.0, when using the     OpenSSL, axtls, qsossl or gskit libraries for TLS,     recognize a wildcard IP address in the subject's Common     Name (CN) field of an X.509 certificate, which might     allow man-in-the-middle attackers to spoof arbitrary     SSL servers via a crafted certificate issued by a     legitimate Certification Authority.i1/4^CVE-2014-0139i1/4%0

  - curl and libcurl 7.27.0 through 7.35.0, when running on     Windows and using the SChannel/Winssl TLS backend, does     not verify that the server hostname matches a domain     name in the subject's Common Name (CN) or     subjectAltName field of the X.509 certificate when     accessing a URL that uses a numerical IP address, which     allows man-in-the-middle attackers to spoof servers via     an arbitrary valid certificate.i1/4^CVE-2014-2522i1/4%0

  - The ourWriteOut function in tool_writeout.c in curl     7.53.1 might allow physically proximate attackers to     obtain sensitive information from process memory in     opportunistic circumstances by reading a workstation     screen during use of a --write-out argument ending in a     '%' character, which leads to a heap-based buffer     over-read.i1/4^CVE-2017-7407i1/4%0

  - It was found that curl and libcurl might send their     Authentication header to a third party HTTP server upon     receiving an HTTP REDIRECT reply. This could leak     authentication token to external     entities.i1/4^CVE-2018-1000007i1/4%0

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
90251	HP System Management Homepage < 7.2.6 Multiple Vulnerabilities (FREAK)	Nessus	Web Servers	2016/3/29	2022/4/11	high
83155	Mandriva Linux Security Advisory : lftp (MDVSA-2015:213)	Nessus	Mandriva Local Security Checks	2015/4/30	2021/1/14	medium
74406	Fedora 20 : mingw-curl-7.37.0-1.fc20 (2014-6912)	Nessus	Fedora Local Security Checks	2014/6/10	2021/1/11	medium
74408	Fedora 19 : mingw-curl-7.37.0-1.fc19 (2014-6921)	Nessus	Fedora Local Security Checks	2014/6/10	2021/1/11	medium
81784	IBM Rational ClearQuest 7.1.x < 7.1.2.16 / 8.0.0.x < 8.0.0.13 / 8.0.1.x < 8.0.1.6 Multiple Vulnerabilities (credentialed check) (POODLE)	Nessus	Windows	2015/3/12	2023/6/23	low
74115	SuSE 11.3 Security Update : curl (SAT Patch Number 9133)	Nessus	SuSE Local Security Checks	2014/5/21	2021/1/19	medium
74418	Mandriva Linux Security Advisory : curl (MDVSA-2014:110)	Nessus	Mandriva Local Security Checks	2014/6/10	2021/1/6	medium
73247	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : curl (SSA:2014-086-01)	Nessus	Slackware Local Security Checks	2014/3/31	2021/1/14	medium
75339	openSUSE Security Update : curl (openSUSE-SU-2014:0598-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
82351	Mandriva Linux Security Advisory : curl (MDVSA-2015:098)	Nessus	Mandriva Local Security Checks	2015/3/30	2021/1/14	medium
73486	Debian DSA-2902-1 : curl - security update	Nessus	Debian Local Security Checks	2014/4/14	2021/1/11	medium
123858	EulerOS Virtualization 2.5.3 : curl (EulerOS-SA-2019-1172)	Nessus	Huawei Local Security Checks	2019/4/9	2024/6/4	critical

偵測

搜尋 Plugin

high

medium

medium

medium

low

medium

medium

medium

medium

medium

medium

critical