When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.
Cuando es instruido a curl descargar un contenido usando la funcionalidad metalink, el contenido es comprobado con un hash proporcionado en el archivo XML metalink. El archivo XML metalink indica al cliente cómo obtener el mismo contenido de un conjunto de URLs diferentes, potencialmente alojadas en distintos servidores y el cliente puede entonces descargar el archivo de uno o varios de ellos. En una manera paralela o en serie. Si uno de los servidores que aloja el contenido ha sido violado y el contenido del archivo específico en ese servidor es reemplazado por una carga útil modificada, Curl debería detectar esto cuando el hash del archivo no coincide después de una descarga completa. Debería eliminar los contenidos y tratar de obtenerlo de otra URL. Esto no se hace, y en su lugar, tal desajuste de hash sólo se menciona en el texto y el contenido potencialmente malicioso se mantiene en el archivo en el disco
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | HIGH |
| Availability Impact | NONE |
AV:N/AC:M/Au:N/C:N/I:P/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | MEDIUM |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | PARTIAL |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-840
|
| [email protected] | Primary |
en
CWE-755
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | curl | * | <built-in method update of dict object at 0x7fd3849ffcc0> | Application |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x7fd39c4a6900> | Operating System |
| netapp | cloud_backup | - | <built-in method update of dict object at 0x7fd369d6d840> | Application |
| netapp | clustered_data_ontap | - | <built-in method update of dict object at 0x7fd369d6dbc0> | Application |
| netapp | hci_management_node | - | <built-in method update of dict object at 0x7fd39c4a6880> | Application |
| netapp | solidfire | - | <built-in method update of dict object at 0x7fd39c4a4180> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd36865eac0> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd369d6cbc0> | Application |
| siemens | sinec_infrastructure_network_services | * | <built-in method update of dict object at 0x7fd369d6ef00> | Application |
| netapp | h300s_firmware | - | <built-in method update of dict object at 0x7fd39c4a4900> | Operating System |
| netapp | h500s_firmware | - | <built-in method update of dict object at 0x7fd384a64900> | Operating System |
| netapp | h700s_firmware | - | <built-in method update of dict object at 0x7fd369d6ca00> | Operating System |
| netapp | h300e_firmware | - | <built-in method update of dict object at 0x7fd384a65480> | Operating System |
| netapp | h500e_firmware | - | <built-in method update of dict object at 0x7fd36865ee80> | Operating System |
| netapp | h700e_firmware | - | <built-in method update of dict object at 0x7fd36865c500> | Operating System |
| netapp | h410s_firmware | - | <built-in method update of dict object at 0x7fd36865da00> | Operating System |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd39c4a6800> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd369d6d140> | Application |
| splunk | universal_forwarder | 9.1.0 | <built-in method update of dict object at 0x7fd3845fd580> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |