En

curl官网安全更新(2019-06-12)

来源:curl官网 发布日期:2019-06-12 阅读次数:329 评论:0

基本信息

发布日期:2019-06-12(官方当地时间)

更新类型:安全更新

更新版本:未知

感知时间:2019-12-05 19:42:00

风险等级:高危

情报贡献:TSRC

更新标题

Windows OpenSSL engine code injection

更新详情

curl / Docs / Security Problems / Windows OpenSSL engine code injectionRelated:
Bug Bounty
Changelog
Donate
FAQ
Security Problems
Security Process
Vulnerabilities TableWindows OpenSSL engine code injection
Project curl Security Advisory, June 24th 2019 -
Permalink
VULNERABILITY
A non-privileged user or program can put code and a config file in a known
non-privileged path (under C:/usr/local/) that will make curl automatically
run the code (as an openssl "engine") on invocation. If that curl is invoked
by a privileged user it can do anything it wants.
This flaw exists in the official curl-for-windows binaries built and hosted by
the curl project (all versions up to and including 7.65.1_1). It does not
exist in the curl executable shipped by Microsoft, bundled with Windows 10. It
possibly exists in other curl builds for Windows too that uses OpenSSL.
The curl project has provided official curl executable builds for Windows
since late August
2018.
There exists proof of concept exploits of this flaw.
INFO
This bug sneaked in partly due to insecure default build options in OpenSSL
when built cross-compiled and partly due to a misleading commit message in the
curl commit that made it possible to disable this feature.
This bug does not exist in the curl or libcurl source code but in the scripts
for the Windows build.
The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2019-5443 to this issue.
CWE-94: Code Injection
Severity: High
AFFECTED VERSIONSAffected versions: all curl-for-windows downloads before 7.65.1_2.THE SOLUTION
Replace your downloaded curl version on Windows with the updated download
package from the curl site.
The build fix for curl-for-win correcting this flaw is in this
commit. It
completely disables curl's ability to load an OpenSSL config when invoked.
RECOMMENDATIONS
We suggest you take one of the following actions immediately, in order of
preference:
A - Upgrade to a fixed curl executable
B - Remove curl executable downloaded from curl.haxx.se and instead use the
one shipped by Microsoft in Windows 10
TIMELINE
The issue was reported to the curl project on June 12, 2019. The fix was done,
verified and communicated with the reporter on June 12, 2019.
While planning the release schedule of this advisory and coordinating with
other affected projects, we discovered that this exact flaw had already been
published and discussed in public before we were informed about it. A few
other OpenSSL-using projects on Windows also had already fixed their builds
for this exact problem. Realizing this, we switched gears and decided to
publish as soon as possible to minimize user impact.
curl 7.65.1_2 for Windows was uploaded and made available on June 21 2019 -
the older, vulnerable builds, were removed from the site at the same time.
This advisory was posted on June 24th 2019.
CREDITS
Reported by Rich Mirch. OpenSSL patch by Viktor Szakats.
Thanks a lot!

软件描述

cURL是一个利用URL语法在命令行下工作的文件传输工具,1997年首次发行。它支持文件上传和下载,所以是综合传输工具,但按传统,习惯称cURL为下载工具

CVE编号

TSRC分析

暂无

业界资讯

暂无

评论

提交评论 您输入的评论有误,请重新输入