9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
70.6%
The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the curl-7.76.1-28.el9 build changelog.
Note that Nessus has not tested for this issue but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# the CentOS Stream Build Service.
##
include('compat.inc');
if (description)
{
script_id(191362);
script_version("1.4");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/04/29");
script_cve_id("CVE-2023-38545");
script_xref(name:"IAVA", value:"2023-A-0531-S");
script_xref(name:"CEA-ID", value:"CEA-2023-0052");
script_name(english:"CentOS 9 : curl-7.76.1-28.el9");
script_set_attribute(attribute:"synopsis", value:
"The remote CentOS host is missing a security update for curl.");
script_set_attribute(attribute:"description", value:
"The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the
curl-7.76.1-28.el9 build changelog.
- This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to
pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting
done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected
to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due
to this bug, the local variable that means let the host resolve the name could get the wrong value
during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target
buffer instead of copying just the resolved address there. The target buffer being a heap based buffer,
and the host name coming from the URL that curl has been told to operate with. (CVE-2023-38545)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
script_set_attribute(attribute:"see_also", value:"https://kojihub.stream.centos.org/koji/buildinfo?buildID=39513");
script_set_attribute(attribute:"solution", value:
"Update the CentOS 9 Stream curl package.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-38545");
script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
script_set_attribute(attribute:"exploit_available", value:"true");
script_set_attribute(attribute:"vuln_publication_date", value:"2023/10/10");
script_set_attribute(attribute:"patch_publication_date", value:"2023/10/10");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/02/29");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:centos:centos:9");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:curl");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:curl-minimal");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libcurl");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libcurl-devel");
script_set_attribute(attribute:"cpe", value:"p-cpe:/a:centos:centos:libcurl-minimal");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"CentOS Local Security Checks");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("ssh_get_info.nasl");
script_require_keys("Host/local_checks_enabled", "Host/CentOS/release", "Host/CentOS/rpm-list", "Host/cpu");
exit(0);
}
include('rpm.inc');
include('rhel.inc');
if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/CentOS/release');
if (isnull(os_release) || 'CentOS' >!< os_release) audit(AUDIT_OS_NOT, 'CentOS');
var os_ver = pregmatch(pattern: "CentOS(?: Stream)?(?: Linux)? release ([0-9]+)", string:os_release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'CentOS');
os_ver = os_ver[1];
if (!rhel_check_release(operator: 'ge', os_version: os_ver, rhel_version: '9')) audit(AUDIT_OS_NOT, 'CentOS 9.x', 'CentOS ' + os_ver);
if (!get_kb_item('Host/CentOS/rpm-list')) audit(AUDIT_PACKAGE_LIST_MISSING);
var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu && 'ppc' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'CentOS', cpu);
var pkgs = [
{'reference':'curl-7.76.1-28.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'curl-minimal-7.76.1-28.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-7.76.1-28.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-devel-7.76.1-28.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE},
{'reference':'libcurl-minimal-7.76.1-28.el9', 'release':'9', 'rpm_spec_vers_cmp':TRUE}
];
var flag = 0;
foreach var package_array ( pkgs ) {
var reference = NULL;
var _release = NULL;
var sp = NULL;
var _cpu = NULL;
var el_string = NULL;
var rpm_spec_vers_cmp = NULL;
var epoch = NULL;
var allowmaj = NULL;
if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
if (!empty_or_null(package_array['release'])) _release = 'CentOS-' + package_array['release'];
if (!empty_or_null(package_array['sp'])) sp = package_array['sp'];
if (!empty_or_null(package_array['cpu'])) _cpu = package_array['cpu'];
if (!empty_or_null(package_array['el_string'])) el_string = package_array['el_string'];
if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
if (!empty_or_null(package_array['epoch'])) epoch = package_array['epoch'];
if (!empty_or_null(package_array['allowmaj'])) allowmaj = package_array['allowmaj'];
if (reference && _release) {
if (rpm_check(release:_release, sp:sp, cpu:_cpu, reference:reference, epoch:epoch, el_string:el_string, rpm_spec_vers_cmp:rpm_spec_vers_cmp, allowmaj:allowmaj)) flag++;
}
}
if (flag)
{
security_report_v4(
port : 0,
severity : SECURITY_HOLE,
extra : rpm_report_get()
);
exit(0);
}
else
{
var tested = pkg_tests_get();
if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal');
}
Vendor | Product | Version | CPE |
---|---|---|---|
centos | centos | curl | p-cpe:/a:centos:centos:curl |
centos | centos | 9 | cpe:/a:centos:centos:9 |
centos | centos | libcurl | p-cpe:/a:centos:centos:libcurl |
centos | centos | libcurl-minimal | p-cpe:/a:centos:centos:libcurl-minimal |
centos | centos | libcurl-devel | p-cpe:/a:centos:centos:libcurl-devel |
centos | centos | curl-minimal | p-cpe:/a:centos:centos:curl-minimal |
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
8.1 High
AI Score
Confidence
Low
0.003 Low
EPSS
Percentile
70.6%