SUSE MicroOS and Linux Enterprise Module for Basesystem update for curl



Risk Medium
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2021-22946
CVE-2021-22947
CWE-ID CWE-319
CWE-345
Exploitation vector Network
Public exploit N/A
Vulnerable software
 SUSE MicroOS
Operating systems & Components / Operating system

SUSE Linux Enterprise Module for Basesystem
Operating systems & Components / Operating system

Vendor SUSE

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Cleartext transmission of sensitive information

EUVDB-ID: #VU56613

Risk: Medium

CVSSv4.0: 4.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22946

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to an error, related to incorrect enforcement of the --ssl-reqd option on the command line or CURLOPT_USE_SSL setting set to CURLUSESSL_CONTROL or CURLUSESSL_ALL with libcurl. A remote attacker with control over the IMAP, POP3 or FTP server can send a specially crafted but perfectly legitimate response to the libcurl client and force it silently to continue its operations without TLS encryption and transmit data in clear text over the network.

Mitigation

Install update from vendor's website.

  • SUSE MicroOS 5.1 (aarch64 s390x x86_64):
    • curl-7.66.0-4.27.1
    • curl-debuginfo-7.66.0-4.27.1
    • curl-debugsource-7.66.0-4.27.1
    • libcurl4-7.66.0-4.27.1
    • libcurl4-debuginfo-7.66.0-4.27.1
  • SUSE MicroOS 5.0 (aarch64 x86_64):
    • curl-7.66.0-4.27.1
    • curl-debuginfo-7.66.0-4.27.1
    • curl-debugsource-7.66.0-4.27.1
    • libcurl4-7.66.0-4.27.1
    • libcurl4-debuginfo-7.66.0-4.27.1
  • SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64):
    • curl-7.66.0-4.27.1
    • curl-debuginfo-7.66.0-4.27.1
    • curl-debugsource-7.66.0-4.27.1
    • libcurl-devel-7.66.0-4.27.1
    • libcurl4-7.66.0-4.27.1
    • libcurl4-debuginfo-7.66.0-4.27.1
  • SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64):
    • libcurl4-32bit-7.66.0-4.27.1
    • libcurl4-32bit-debuginfo-7.66.0-4.27.1
  • SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x x86_64):
    • curl-7.66.0-4.27.1
    • curl-debuginfo-7.66.0-4.27.1
    • curl-debugsource-7.66.0-4.27.1
    • libcurl-devel-7.66.0-4.27.1
    • libcurl4-7.66.0-4.27.1
    • libcurl4-debuginfo-7.66.0-4.27.1
  • SUSE Linux Enterprise Module for Basesystem 15-SP2 (x86_64):
    • libcurl4-32bit-7.66.0-4.27.1
    • libcurl4-32bit-debuginfo-7.66.0-4.27.1

Vulnerable software versions

SUSE MicroOS: 5.0 - 5.1

SUSE Linux Enterprise Module for Basesystem: 15-SP2 - 15-SP3

CPE2.3 External links

https://www.suse.com/support/update/announcement/2021/suse-su-20213298-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Insufficient verification of data authenticity

EUVDB-ID: #VU56615

Risk: Medium

CVSSv4.0: 4.2 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2021-22947

CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists in the way libcurl handles the STARTTLS negotiation process. When curl connects to an IMAP, POP3, SMTP or FTP server to exchange data securely using STARTTLS to upgrade the connection to TLS level, the server can still respond and send back multiple responses before the TLS upgrade. Such multiple "pipelined" responses are cached by curl. curl would then upgrade to TLS but not flush the in-queue of cached responses and instead use and trust the responses it got before the TLS handshake as if they were authenticated.

Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.

Over POP3 and IMAP an attacker can inject fake response data.

Mitigation

Install update from vendor's website.

  • SUSE MicroOS 5.1 (aarch64 s390x x86_64):
    • curl-7.66.0-4.27.1
    • curl-debuginfo-7.66.0-4.27.1
    • curl-debugsource-7.66.0-4.27.1
    • libcurl4-7.66.0-4.27.1
    • libcurl4-debuginfo-7.66.0-4.27.1
  • SUSE MicroOS 5.0 (aarch64 x86_64):
    • curl-7.66.0-4.27.1
    • curl-debuginfo-7.66.0-4.27.1
    • curl-debugsource-7.66.0-4.27.1
    • libcurl4-7.66.0-4.27.1
    • libcurl4-debuginfo-7.66.0-4.27.1
  • SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64):
    • curl-7.66.0-4.27.1
    • curl-debuginfo-7.66.0-4.27.1
    • curl-debugsource-7.66.0-4.27.1
    • libcurl-devel-7.66.0-4.27.1
    • libcurl4-7.66.0-4.27.1
    • libcurl4-debuginfo-7.66.0-4.27.1
  • SUSE Linux Enterprise Module for Basesystem 15-SP3 (x86_64):
    • libcurl4-32bit-7.66.0-4.27.1
    • libcurl4-32bit-debuginfo-7.66.0-4.27.1
  • SUSE Linux Enterprise Module for Basesystem 15-SP2 (aarch64 ppc64le s390x x86_64):
    • curl-7.66.0-4.27.1
    • curl-debuginfo-7.66.0-4.27.1
    • curl-debugsource-7.66.0-4.27.1
    • libcurl-devel-7.66.0-4.27.1
    • libcurl4-7.66.0-4.27.1
    • libcurl4-debuginfo-7.66.0-4.27.1
  • SUSE Linux Enterprise Module for Basesystem 15-SP2 (x86_64):
    • libcurl4-32bit-7.66.0-4.27.1
    • libcurl4-32bit-debuginfo-7.66.0-4.27.1

Vulnerable software versions

SUSE MicroOS: 5.0 - 5.1

SUSE Linux Enterprise Module for Basesystem: 15-SP2 - 15-SP3

CPE2.3 External links

https://www.suse.com/support/update/announcement/2021/suse-su-20213298-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###