Lucene search

Kaspersky LabKLA10815

HistoryMay 18, 2016 - 12:00 a.m.

KLA10815 Security bypass vulnerability in cURL

2016-05-1800:00:00

Kaspersky Lab

threats.kaspersky.com

2.6 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:N/I:P/A:N

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

5.8 Medium

AI Score

Confidence

High

0.008 Low

EPSS

Percentile

81.1%

JSON

An improper TLS connections handling was found in cURL. By exploiting this vulnerability malicious users can bypass sec. This vulnerability can be exploited remotely via TLS certificate manipulations.

Technical details

Libcurl affected only if mbedTLS or PolarSSL as TLS backend.

Original advisories

Vendor advisory

Related products

cURL

CVE list

CVE-2016-3739 warning

Solution

Update to the latest version

cURL download page

Impacts

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.