CVE编号
CVE-2019-3822利用情况
暂无补丁情况
官方补丁披露时间
2019-02-07漏洞描述
从7.36.0到7.64.0之前的libcurl版本容易受到基于堆栈的缓冲区溢出的影响。创建outgoing NTLM type-3 header (`lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message()`)的函数基于先前接收的数据生成请求HTTP标头内容。用于防止本地缓冲区溢出的检查是错误地实现的(使用无符号数学运算)，因此它不会阻止溢出发生。如果从恶意或损坏的HTTP服务器提供的先前NTLMv2报头中提取非常大的“nt响应”数据，则此输出数据可能比本地缓冲区大。这种“大值”需要大约1000字节或更多。复制到目标缓冲区的实际有效负载数据来自NTLMv2 type-2 response header。解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接 |
|
|---|---|
| http://www.securityfocus.com/bid/106950 | |
| https://access.redhat.com/errata/RHSA-2019:3701 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3822 | |
| https://cert-portal.siemens.com/productcert/pdf/ssa-436177.pdf | |
| https://curl.haxx.se/docs/CVE-2019-3822.html | |
| https://lists.apache.org/thread.html/8338a0f605bdbb3a6098bb76f666a95fc2b2f53f... | |
| https://security.gentoo.org/glsa/201903-03 | |
| https://security.netapp.com/advisory/ntap-20190315-0001/ | |
| https://security.netapp.com/advisory/ntap-20190719-0004/ | |
| https://support.f5.com/csp/article/K84141449 | |
| https://support.f5.com/csp/article/K84141449?utm_source=f5support&utm_medium=RSS | |
| https://usn.ubuntu.com/3882-1/ | |
| https://www.debian.org/security/2019/dsa-4386 | |
| https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html | |
| https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html |
受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | haxx | libcurl | * |
From (including) 7.36.0 |
Up to (excluding) 7.64.0 |
||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | communications_operations_monitor | 3.4 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | communications_operations_monitor | 4.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | enterprise_manager_ops_center | 12.3.3 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | enterprise_manager_ops_center | 12.4.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | http_server | 12.2.1.3.0 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | mysql_server | * |
Up to (including) 5.7.26 |
|||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | mysql_server | * |
From (including) 5.7.27 |
Up to (including) 8.0.15 |
||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | secure_global_desktop | 5.4 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | oracle | services_tools_bundle | 19.2 | - | |||||
| 运行在以下环境 | |||||||||
| 应用 | siemens | sinema_remote_connect_client | * |
Up to (including) 2.0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.10 | curl | * |
Up to (excluding) 7.64.0-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.11 | curl | * |
Up to (excluding) 7.64.0-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.12 | curl | * |
Up to (excluding) 7.64.0-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.13 | curl | * |
Up to (excluding) 7.64.0-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.14 | curl | * |
Up to (excluding) 7.64.0-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.15 | curl | * |
Up to (excluding) 7.64.0-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.6 | curl | * |
Up to (excluding) 7.61.1-r2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.7 | curl | * |
Up to (excluding) 7.61.1-r2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.8 | curl | * |
Up to (excluding) 7.61.1-r2 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.9 | curl | * |
Up to (excluding) 7.64.0-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_edge | curl | * |
Up to (excluding) 7.64.0-r0 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon linux_2 | curl | * |
Up to (excluding) 7.61.1-9.amzn2.0.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon linux_AMI | curl | * |
Up to (excluding) 5.7.27-1.13.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | curl | * |
Up to (excluding) 7.61.1-9.amzn2.0.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | curl | * |
Up to (excluding) 5.7.27-1.13.amzn1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 14.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 16.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 18.04 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | canonical | ubuntu_linux | 18.10 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | centos_8 | curl | * |
Up to (excluding) 7.61.1-11.el8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian | debian_linux | 9.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_8 | curl | * |
Up to (excluding) 7.38.0-4+deb8u1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | curl | * |
Up to (excluding) 7.52.1-5+deb9u9 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_29 | curl | * |
Up to (excluding) 7.61.1-8.fc29 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | netapp | active_iq_unified_manager_for_vmware_vsphere | * |
From (including) 9.5 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | netapp | active_iq_unified_manager_for_windows | * |
From (including) 7.3 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | netapp | clustered_data_ontap | * | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | netapp | oncommand_insight | - | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | netapp | oncommand_workflow_automation | - | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | netapp | snapcenter | - | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.0 | curl | * |
Up to (excluding) 7.60.0-lp150.2.18.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_42.3 | curl | * |
Up to (excluding) 7.37.0-45.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle linux_8 | curl | * |
Up to (excluding) 7.61.1-11.el8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_8 | curl | * |
Up to (excluding) 7.61.1-11.el8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | redhat | enterprise_linux | 8.0 | - | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_8 | curl | * |
Up to (excluding) 7.61.1-11.el8 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12 | curl | * |
Up to (excluding) 7.37.0-37.34 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12_SP3 | curl | * |
Up to (excluding) 7.37.0-37.34.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | sles_12_SP4 | curl | * |
Up to (excluding) 7.60.0-4.3.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP3 | curl | * |
Up to (excluding) 7.37.0-37.34.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP4 | curl | * |
Up to (excluding) 7.60.0-4.3.1 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04 | curl | * |
Up to (excluding) 7.47.0-1ubuntu2.12 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04_lts | curl | * |
Up to (excluding) 7.47.0-1ubuntu2.12 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04 | curl | * |
Up to (excluding) 7.58.0-2ubuntu3.6 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04_lts | curl | * |
Up to (excluding) 7.58.0-2ubuntu3.6 |
|||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.10 | curl | * |
Up to (excluding) 7.61.0-1ubuntu2.3 |
|||||
- 攻击路径 远程
- 攻击复杂度 复杂
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 未验证
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
还没有评论，来说两句吧...