Ubuntu update for curl



Published: 2023-03-27
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2023-27533
CVE-2023-27535
CVE-2023-27536
CWE-ID CWE-20
CWE-371
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Ubuntu
Operating systems & Components / Operating system

curl (Ubuntu package)
Operating systems & Components / Operating system package or component

libcurl3 (Ubuntu package)
Operating systems & Components / Operating system package or component

libcurl3-nss (Ubuntu package)
Operating systems & Components / Operating system package or component

libcurl3-gnutls (Ubuntu package)
Operating systems & Components / Operating system package or component

Vendor Canonical Ltd.

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU73826

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-27533

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to manipulate requests.

The vulnerability exists due to missing documentation of the TELNET protocol support and the ability to pass on user name and "telnet options" for the server negotiation. A remote attacker can manipulate the connection sending unexpected data to the server via the affected client.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

curl (Ubuntu package): before Ubuntu Pro (Infra-only)

libcurl3 (Ubuntu package): before Ubuntu Pro (Infra-only)

libcurl3-nss (Ubuntu package): before Ubuntu Pro (Infra-only)

libcurl3-gnutls (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-5964-2


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) State Issues

EUVDB-ID: #VU73828

Risk: Low

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-27535

CWE-ID: CWE-371 - State Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to FTP server.

The vulnerability exists due to cURL will reuse a previously created FTP connection even when one or more options had been changed that could have made the effective user a very different one. A remote attacker can connect to the FTP server using credentials supplied by another user and gain access to otherwise restricted functionality.

The settings in questions are CURLOPT_FTP_ACCOUNT, CURLOPT_FTP_ALTERNATIVE_TO_USER, CURLOPT_FTP_SSL_CCC and CURLOPT_USE_SSL level.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

curl (Ubuntu package): before Ubuntu Pro (Infra-only)

libcurl3 (Ubuntu package): before Ubuntu Pro (Infra-only)

libcurl3-nss (Ubuntu package): before Ubuntu Pro (Infra-only)

libcurl3-gnutls (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-5964-2


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) State Issues

EUVDB-ID: #VU73829

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-27536

CWE-ID: CWE-371 - State Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to cURL will reuse a previously created connection even when the GSS delegation (CURLOPT_GSSAPI_DELEGATION) option had been changed that could have changed the user's permissions in a second transfer. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, this GSS delegation setting was left out from the configuration match checks, making them match too easily, affecting krb5/kerberos/negotiate/GSSAPI transfers.

Mitigation

Update the affected package curl to the latest version.

Vulnerable software versions

Ubuntu: 14.04 - 16.04

curl (Ubuntu package): before Ubuntu Pro (Infra-only)

libcurl3 (Ubuntu package): before Ubuntu Pro (Infra-only)

libcurl3-nss (Ubuntu package): before Ubuntu Pro (Infra-only)

libcurl3-gnutls (Ubuntu package): before Ubuntu Pro (Infra-only)

External links

http://ubuntu.com/security/notices/USN-5964-2


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###