VMware Tanzu update for cURL

1) Improper certificate validation

EUVDB-ID: #VU76237

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-28321

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation when matching wildcards in TLS certificates for IDN names. A remote attacker crate a specially crafted certificate that will be considered trusted by the library.

Successful exploitation of the vulnerability requires that curl is built to use OpenSSL, Schannel or Gskit.

Mitigation

Install update from vendor's website.

Vulnerable software versions

VMware Tanzu Application Service for VMs: 2.11.0 - 4.0.9

Isolation Segment: 2.11.0 - 4.0.9

VMware Tanzu Operations Manager: 2.10 - 2.10.60

Platform Automation Toolkit: 4.4.1 - 5.1.1

External links

http://tanzu.vmware.com/security/usn-6237-3

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Expected behavior violation

EUVDB-ID: #VU76238

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-28322

CWE-ID: CWE-440 - Expected Behavior Violation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to a logic error when sending HTTP POST and PUT requests using the same handle. The libcurl can erroneously use the read callback (CURLOPT_READFUNCTION) to ask for data to send, even when the CURLOPT_POSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. As a result, the application can misbehave and either send off the wrong data or use memory after free or similar in the second transfer.

Mitigation

Install update from vendor's website.

Vulnerable software versions

VMware Tanzu Application Service for VMs: 2.11.0 - 4.0.9

Isolation Segment: 2.11.0 - 4.0.9

VMware Tanzu Operations Manager: 2.10 - 2.10.60

Platform Automation Toolkit: 4.4.1 - 5.1.1

External links

http://tanzu.vmware.com/security/usn-6237-3

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Time-of-check Time-of-use (TOCTOU) Race Condition

EUVDB-ID: #VU78540

Risk: Low

CVSSv3.1: 2 [CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-32001

CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition

Exploit availability: No

Description

The vulnerability allows a local users to escalate privileges on the system.

The vulnerability exists due to a race condition when calling fopen() on STS and/or alt-svc data to files. A local user can create or rename directory entries in the directory the victim saves their files and abuse the symbolic link behavior to overwrite arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

VMware Tanzu Application Service for VMs: 2.11.0 - 4.0.9

Isolation Segment: 2.11.0 - 4.0.9

VMware Tanzu Operations Manager: 2.10 - 2.10.60

Platform Automation Toolkit: 4.4.1 - 5.1.1

External links

http://tanzu.vmware.com/security/usn-6237-3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.