A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automatically run the code (as an openssl "engine") on invocation. If that curl is invoked by a privileged user it can do anything it wants.
Un usuario o programa no privilegiado puede colocar un código y un archivo de configuración en una ruta (path) no privilegiada conocida (bajo C:/usr/local/) que hará que curl anterior a versión 7.65.1 incluyéndola, ejecute automáticamente el código en la invocación (como un "engine" openssl). Si ese curl es invocado por un usuario privilegiado, este puede hacer lo que desee.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
AV:L/AC:M/Au:N/C:P/I:P/A:P
| Access Vector | LOCAL |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-94
|
| [email protected] | Primary |
en
CWE-427
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | curl | * | <built-in method update of dict object at 0x7fd385557700> | Application |
| oracle | enterprise_manager_ops_center | 12.3.3 | <built-in method update of dict object at 0x7fd36b366740> | Application |
| oracle | enterprise_manager_ops_center | 12.4.0 | <built-in method update of dict object at 0x7fd3081a7c40> | Application |
| oracle | http_server | 12.2.1.3.0 | <built-in method update of dict object at 0x7fd3846900c0> | Application |
| oracle | http_server | 12.2.1.4.0 | <built-in method update of dict object at 0x7fd385556f00> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd385556e00> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd37018c380> | Application |
| oracle | oss_support_tools | 20.0 | <built-in method update of dict object at 0x7fd37018ddc0> | Application |
| netapp | oncommand_insight | - | <built-in method update of dict object at 0x7fd2a0135100> | Application |
| netapp | oncommand_unified_manager | * | <built-in method update of dict object at 0x7fd385557d00> | Application |
| netapp | oncommand_unified_manager | * | <built-in method update of dict object at 0x7fd2db0f9600> | Application |
| netapp | oncommand_workflow_automation | - | <built-in method update of dict object at 0x7fd3694da100> | Application |
| netapp | snapcenter | - | <built-in method update of dict object at 0x7fd3694db6c0> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:http_server:12.2.1.3.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:oss_support_tools:20.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:windows:*:* |
| Yes | cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:vmware_vsphere:*:* |
| Yes | cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* |