cURL/libcURL CVE-2014-0139 SSL Certificate Validation Security Bypass Vulnerability
BID:66458
Info
cURL/libcURL CVE-2014-0139 SSL Certificate Validation Security Bypass Vulnerability
| Bugtraq ID: | 66458 |
| Class: | Design Error |
| CVE: |
CVE-2014-0139 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 26 2014 12:00AM |
| Updated: | Jul 15 2015 12:03AM |
| Credit: | Richard Moore |
| Vulnerable: |
Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 SuSE openSUSE 11.4 Slackware Linux 13.37 Slackware Linux 13.1 Slackware Linux 13.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Daniel Stenberg curl 7.20 Daniel Stenberg curl 7.19.6 Daniel Stenberg curl 7.19.5 Daniel Stenberg curl 7.19.4 Daniel Stenberg curl 7.19.3 Daniel Stenberg curl 7.19 Daniel Stenberg curl 7.18.1 Daniel Stenberg curl 7.18 Daniel Stenberg curl 7.17 Daniel Stenberg curl 7.16.4 Daniel Stenberg curl 7.15.5 Daniel Stenberg curl 7.15.3 Daniel Stenberg curl 7.15.2 Daniel Stenberg curl 7.15.1 Daniel Stenberg curl 7.15 Daniel Stenberg curl 7.14.1 Daniel Stenberg curl 7.14 Daniel Stenberg curl 7.13.2 Daniel Stenberg curl 7.13.1 Daniel Stenberg curl 7.13 Daniel Stenberg curl 7.12.3 Daniel Stenberg curl 7.12.2 Daniel Stenberg curl 7.12.1 Daniel Stenberg curl 7.12 Daniel Stenberg curl 7.11.2 Daniel Stenberg curl 7.11.1 Daniel Stenberg curl 7.11 Daniel Stenberg curl 7.10.8 Daniel Stenberg curl 7.10.7 Daniel Stenberg curl 7.10.6 Daniel Stenberg curl 7.10.5 Daniel Stenberg curl 7.10.4 Daniel Stenberg curl 7.10.3 Daniel Stenberg curl 7.10.2 Daniel Stenberg curl 7.10.1 Daniel Stenberg curl 7.10 Daniel Stenberg curl 7.9.8 Daniel Stenberg curl 7.9.7 Daniel Stenberg curl 7.9.6 Daniel Stenberg curl 7.9.5 Daniel Stenberg curl 7.9.4 Daniel Stenberg curl 7.9.3 Daniel Stenberg curl 7.9.2 Daniel Stenberg curl 7.9.1 Daniel Stenberg curl 7.9 Daniel Stenberg curl 7.8.2 Daniel Stenberg curl 7.8.1 Daniel Stenberg curl 7.8 Daniel Stenberg curl 7.7.3 Daniel Stenberg curl 7.7.2 Daniel Stenberg curl 7.7.1 Daniel Stenberg curl 7.7 Daniel Stenberg curl 7.6.1 Daniel Stenberg curl 7.6 Daniel Stenberg curl 7.5.2 Daniel Stenberg curl 7.5.1 Daniel Stenberg curl 7.5 Daniel Stenberg curl 7.4.2 Daniel Stenberg curl 7.4.1 Daniel Stenberg curl 7.4 Daniel Stenberg curl 7.3 Daniel Stenberg curl 7.2.1 Daniel Stenberg curl 7.2 Daniel Stenberg curl 7.1.1 Daniel Stenberg curl 7.1 Daniel Stenberg curl 7.24.0 Daniel Stenberg curl 7.23.1 Daniel Stenberg curl 7.21.7 Daniel Stenberg curl 7.20.2 Daniel Stenberg curl 7.20.1 Daniel Stenberg curl 7.16.3 |
| Not Vulnerable: | |
Discussion
cURL/libcURL CVE-2014-0139 SSL Certificate Validation Security Bypass Vulnerability
cURL/libcURL is prone to a security-bypass vulnerability because it fails to properly validate SSL certificates.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
cURL 7.1 through 7.35.0 are vulnerable.
cURL/libcURL is prone to a security-bypass vulnerability because it fails to properly validate SSL certificates.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
cURL 7.1 through 7.35.0 are vulnerable.
Exploit / POC
cURL/libcURL CVE-2014-0139 SSL Certificate Validation Security Bypass Vulnerability
An attacker can use readily available network utilities to exploit this issue.
An attacker can use readily available network utilities to exploit this issue.
Solution / Fix
cURL/libcURL CVE-2014-0139 SSL Certificate Validation Security Bypass Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
cURL/libcURL CVE-2014-0139 SSL Certificate Validation Security Bypass Vulnerability
References:
References:
- cURL Home Page (cURL)