Curl GnuTLS Certificate Verfication Access Validation Vulnerability
BID:24938
Info
Curl GnuTLS Certificate Verfication Access Validation Vulnerability
| Bugtraq ID: | 24938 |
| Class: | Access Validation Error |
| CVE: |
CVE-2007-3564 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 17 2007 12:00AM |
| Updated: | Jul 30 2007 08:25PM |
| Credit: | Kees Cook is credited with the discovery of this vulnerability |
| Vulnerable: |
Ubuntu Ubuntu Linux 7.04 sparc Ubuntu Ubuntu Linux 7.04 powerpc Ubuntu Ubuntu Linux 7.04 i386 Ubuntu Ubuntu Linux 7.04 amd64 Ubuntu Ubuntu Linux 6.10 sparc Ubuntu Ubuntu Linux 6.10 powerpc Ubuntu Ubuntu Linux 6.10 i386 Ubuntu Ubuntu Linux 6.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Trustix Secure Linux 3.0.5 Trustix Secure Linux 3.0 Trustix Secure Linux 2.0 Trustix Operating System Enterprise Server 2.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Daniel Stenberg curl 7.15.3 Daniel Stenberg curl 7.15.2 Daniel Stenberg curl 7.15.1 Daniel Stenberg curl 7.15 Daniel Stenberg curl 7.14.1 Daniel Stenberg curl 7.14 Daniel Stenberg curl 7.16.3 |
| Not Vulnerable: |
Daniel Stenberg curl 7.16.4 |
Discussion
Curl GnuTLS Certificate Verfication Access Validation Vulnerability
Curl is prone to a vulnerability that permits an attacker to access unauthorized websites. The attacker may then launch other attacks.
This issue affects versions prior to Curl 7.16.4. Other applications using the 'libcurl' library are also affected.
Curl is prone to a vulnerability that permits an attacker to access unauthorized websites. The attacker may then launch other attacks.
This issue affects versions prior to Curl 7.16.4. Other applications using the 'libcurl' library are also affected.
Exploit / POC
Curl GnuTLS Certificate Verfication Access Validation Vulnerability
An attacker must obtain a valid expired certificate to exploit this issue
An attacker must obtain a valid expired certificate to exploit this issue
Solution / Fix
Curl GnuTLS Certificate Verfication Access Validation Vulnerability
Solution:
The vendor released an update to address this issue. Please see the references for more information.
Solution:
The vendor released an update to address this issue. Please see the references for more information.
References
Curl GnuTLS Certificate Verfication Access Validation Vulnerability
References:
References:
- Curl Home Page (Daniel Stenberg)
- libcurl GnuTLS insufficient cert verification Vulnerability (Curl )