Published: 23/12/2013 Updated: 07/04/2016

CVSS v2 Base Score: 4 | Impact Score: 4.9 | Exploitability Score: 4.9

VMScore: 356

Vector: AV:N/AC:H/Au:N/C:P/I:P/A:N

The GnuTLS backend in libcurl 7.21.4 up to and including 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote malicious users to spoof servers and conduct man-in-the-middle (MITM) attacks.

Vulnerable Product	Search on Vulmon	Subscribe to Product
debian debian linux 7.0
canonical ubuntu linux 12.10
canonical ubuntu linux 13.10
canonical ubuntu linux 12.04
canonical ubuntu linux 13.04
haxx libcurl 7.30.0
haxx libcurl 7.28.0
haxx libcurl 7.23.1
haxx libcurl 7.21.4
haxx libcurl 7.27.0
haxx libcurl 7.26.0
haxx libcurl 7.25.0
haxx libcurl 7.24.0
haxx libcurl 7.33.0
haxx libcurl 7.32.0
haxx libcurl 7.21.5
haxx libcurl 7.21.6
haxx libcurl 7.21.7
haxx libcurl 7.31.0
haxx libcurl 7.29.0
haxx libcurl 7.28.1
haxx libcurl 7.23.0
haxx libcurl 7.22.0

Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet ...

Marc Deslauriers discovered that curl, a file retrieval tool, would mistakenly skip verifying the CN and SAN name fields when digital signature verification was disabled in the libcurl GnuTLS backend The default configuration for the curl package is not affected by this issue since the digital signature verification is enabled by default The olds ...

The GnuTLS backend in libcurl 7214 through 7330, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks ...

CWE-20 http://www.debian.org/security/2013/dsa-2824 http://www.ubuntu.com/usn/USN-2058-1 http://curl.haxx.se/docs/adv_20131217.html https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html https://usn.ubuntu.com/2058-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2013-6422

CVE-2013-6422

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect