CVE-2013-6422

The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.

CVSS v2.0 4.0 MEDIUM

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:H/Au:N/C:P/I:P/A:N

Exploitability : 4.9 / Impact : 4.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://curl.haxx.se/docs/adv_20131217.html	Vendor Advisory
http://www.debian.org/security/2013/dsa-2824
http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
http://www.ubuntu.com/usn/USN-2058-1
https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322

Configurations

Configuration 1 (hide)

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:::::*
	cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:13.04:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:13.10:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:haxx:libcurl:7.21.4:::::::*
	cpe:2.3:a:haxx:libcurl:7.21.5:::::::*
	cpe:2.3:a:haxx:libcurl:7.21.6:::::::*
	cpe:2.3:a:haxx:libcurl:7.21.7:::::::*
	cpe:2.3:a:haxx:libcurl:7.22.0:::::::*
	cpe:2.3:a:haxx:libcurl:7.23.0:::::::*
	cpe:2.3:a:haxx:libcurl:7.23.1:::::::*
	cpe:2.3:a:haxx:libcurl:7.24.0:::::::*
	cpe:2.3:a:haxx:libcurl:7.25.0:::::::*
	cpe:2.3:a:haxx:libcurl:7.26.0:::::::*
	cpe:2.3:a:haxx:libcurl:7.27.0:::::::*
	cpe:2.3:a:haxx:libcurl:7.28.0:::::::*
	cpe:2.3:a:haxx:libcurl:7.28.1:::::::*
	cpe:2.3:a:haxx:libcurl:7.29.0:::::::*
	cpe:2.3:a:haxx:libcurl:7.30.0:::::::*
	cpe:2.3:a:haxx:libcurl:7.31.0:::::::*
	cpe:2.3:a:haxx:libcurl:7.32.0:::::::*
	cpe:2.3:a:haxx:libcurl:7.33.0:::::::*

History

No history.

Information

Published : 2013-12-23 22:55

Updated : 2016-04-07 20:55

NVD link : CVE-2013-6422

Mitre link : CVE-2013-6422

CVE.ORG link : CVE-2013-6422

JSON object : View

Products Affected

haxx

libcurl

debian

debian_linux

canonical

ubuntu_linux

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2013-6422", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-12-23T22:55:02.943", "references": [{"url": "http://curl.haxx.se/docs/adv_20131217.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.debian.org/security/2013/dsa-2824", "source": "secalert@redhat.com"}, {"url": "http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html", "source": "secalert@redhat.com"}, {"url": "http://www.ubuntu.com/usn/USN-2058-1", "source": "secalert@redhat.com"}, {"url": "https://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c04463322", "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The GnuTLS backend in libcurl 7.21.4 through 7.33.0, when disabling digital signature verification (CURLOPT_SSL_VERIFYPEER), also disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks."}, {"lang": "es", "value": "El backend de GnuTLS en libcurl 7.21.4 a 7.33.0, cuando se desactiva la verificaci\u00f3n de firmas digitales (CURLOPT_SSL_VERIFYPEER), tambi\u00e9n desactiva la comprobaci\u00f3n CURLOPT_SSL_VERIFYHOST para nombres de host CN o SAN, lo cual facilita a atacantes remotos la suplantaci\u00f3n de servidores y la ejecuci\u00f3n de ataques man-in-the-middle (MITM)."}], "lastModified": "2016-04-07T20:55:59.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "16F59A04-14CF-49E2-9973-645477EA09DA"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5D324C4-97C7-49D3-A809-9EAD4B690C69"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFAA48D9-BEB4-4E49-AD50-325C262D46D9"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F61F047-129C-41A6-8A27-FFCBB8563E91"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:haxx:libcurl:7.21.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9EAE25A0-3828-46F1-AB30-88732CBC9F38"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.21.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1533A85C-2160-445D-8787-E624AEDC5A0C"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.21.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D87B9393-7EA4-43DA-900C-7E840AE2D4C2"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.21.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D1249E9-304F-4952-8DAB-8B79CE5E7D54"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.22.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83FAF953-6A65-4FAB-BDB5-03B468CD1C9A"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.23.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29F8FF1F-A639-4161-9366-62528AAF4C07"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.23.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "812AB429-379A-4EDE-9664-5BC2989053F6"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.24.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13DD791F-C4BD-4456-955A-92E84082AA09"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.25.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A17E442-45AA-4780-98B4-9BF764DCC1C5"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.26.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6AF544C-5F16-4434-B9FB-93B1B7318950"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBFD9ED9-2412-44AE-9C55-0ED03A121B23"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.28.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67CCE31B-ABDA-4F32-BAF1-B1AD0664B3E2"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.28.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E66A332-ECD1-4452-B444-FB629022FDF0"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.29.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CDD3D599-35E9-4590-B5E0-3AF04D344695"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.30.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3B6BFFB-7967-482C-9B49-4BD25C815299"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1791BF6D-2C96-4A6E-90D4-2906A73601F6"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "260DD751-4145-4B75-B892-5FC932C6A305"}, {"criteria": "cpe:2.3:a:haxx:libcurl:7.33.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EFF4AD0D-2EC5-4CE8-B6B3-2EC8ED2FF118"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}