Уязвимость атаки "Человек посередине" (Man-In-The-Middle) в curl через некорректную обработку ответов сервера при установке STARTTLS
Описание
В curl версии от 7.20.0 до 7.78.0 при подключении к IMAP или POP3 серверу с использованием STARTTLS для перехода на TLS защиту, сервер может одновременно отправить несколько ответов, которые curl кэширует. Затем curl переходит на TLS, но не очищает очередь кэшированных ответов, продолжая использовать и доверять ответам, полученным еще до выполнения соединения (handshake) TLS, как будто они аутентифицированы. Эта уязвимость позволяет злоумышленнику с атакой типа "Человек посередине" (Man-In-The-Middle) сначала внедрить поддельные ответы, потом передать TLS-трафик от легитимного сервера и обмануть curl, заставив отправить данные пользователю, полагая, что данные от злоумышленника поступают из защищенного TLS сервера.
Затронутые версии ПО
- curl версии от 7.20.0 до 7.78.0
Тип уязвимости
Атака "Человек посередине" (Man-In-The-Middle)
Ссылки
- Mailing ListThird Party Advisory
- PatchThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
- Third Party Advisory
- Third Party Advisory
- Release NotesThird Party Advisory
- Third Party Advisory
- PatchThird Party Advisory
- PatchThird Party Advisory
- PatchThird Party Advisory
- PatchThird Party Advisory
- Mailing ListThird Party Advisory
- PatchThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
- Mailing ListThird Party Advisory
- Mailing ListThird Party Advisory
Уязвимые конфигурации
Одно из
Одно из
Одно из
Одновременно
Одновременно
Одновременно
Одновременно
Одновременно
Одновременно
Одновременно
Одновременно
Одно из
Одно из
Одно из
EPSS
5.9 Medium
CVSS3
4.3 Medium
CVSS2
Дефекты
Связанные уязвимости
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server t ...
When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server.
EPSS
5.9 Medium
CVSS3
4.3 Medium
CVSS2