Boletines de Vulnerabilidades

int(3320)

Boletines de Vulnerabilidades

Salto de restricciones de acceso en libcurl
Clasificación de la vulnerabilidad
Propiedad	Valor
Nivel de Confianza	Oficial
Impacto	Obtener acceso
Dificultad	Experto
Requerimientos del atacante	Acceso remoto sin cuenta a un servicio estandar
Información sobre el sistema
Propiedad	Valor
Fabricante afectado	GNU/Linux
Software afectado	libcurl 7.14.0 <= 7.16.3
Descripción
Se ha encontrado una vulnerabilidad en libcurl de la versión 7.14.0 hasta la 7.16.3. La vulnerabilidad reside al no comprobar la expiración de certificados SSL/TLS o los datos de activación cuando compila con el soporte GnuTLS. Un atacante remoto podría saltarse ciertas restricciones de acceso.
Solución
Actualización de software Debian Debian Linux 4.0 Source http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1.dsc http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5.orig.tar.gz http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1.diff.gz Architecture independent http://security.debian.org/pool/updates/main/c/curl/libcurl3-dev_7.15.5-1etch1_all.deb alpha http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_alpha.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_alpha.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_alpha.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_alpha.deb http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_alpha.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_alpha.deb amd64 http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_amd64.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_amd64.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_amd64.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_amd64.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_amd64.deb http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_amd64.deb arm http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_arm.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_arm.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_arm.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_arm.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_arm.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_arm.deb hppa http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_hppa.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_hppa.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_hppa.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_hppa.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_hppa.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_hppa.deb i386 http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_i386.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_i386.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_i386.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_i386.deb http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_i386.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_i386.deb ia64 http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_ia64.deb http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_ia64.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_ia64.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_ia64.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_ia64.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_ia64.deb mipsel http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_mipsel.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_mipsel.deb powerpc http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_powerpc.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_powerpc.deb s390 http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_s390.deb http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_s390.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_s390.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_s390.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_s390.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_s390.deb sparc http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1etch1_sparc.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-dev_7.15.5-1etch1_sparc.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7.15.5-1etch1_sparc.deb http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch1_sparc.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-dev_7.15.5-1etch1_sparc.deb http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15.5-1etch1_sparc.deb
Identificadores estándar
Propiedad	Valor
CVE	CVE-2007-3564
BID	24938
Recursos adicionales
Debian Security Advisory (DSA 1333-1) http://lists.debian.org/debian-security-announce/debian-security-announce-2007/msg00094.html