curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS`in libcurl. This rarely used option is used to send variable=content pairs toTELNET servers.Due to flaw in the option parser for sending `NEW_ENV` variables, libcurlcould be made to pass on uninitialized data from a stack based buffer to theserver. Therefore potentially revealing sensitive internal information to theserver using a clear-text network protocol.This could happen because curl did not call and use sscanf() correctly whenparsing the string provided by the application.
curl soporta la opción de línea de comandos "-t", conocida como "CURLOPT_TELNETOPTIONS" en libcurl. Debido a un fallo en el analizador de opciones para el envío de variables "NEW_ENV", libcurl podría pasar datos no inicializados de un búfer en la región stack de la memoria al servidor. Por lo tanto, podría revelar potencialmente información interna confidencial al servidor usando un protocolo de red de texto sin cifrar. Esto podría ocurrir porque curl no llamó y usó la función sscanf() apropiadamente al analizar la cadena proporcionada por la aplicación
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | LOW |
| Integrity Impact | NONE |
| Availability Impact | NONE |
AV:N/AC:L/Au:N/C:P/I:N/A:N
| Access Vector | NETWORK |
|---|---|
| Access Complexity | LOW |
| Authentication | NONE |
| Confidentiality Impact | PARTIAL |
| Integrity Impact | NONE |
| Availability Impact | NONE |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-200
|
| [email protected] | Primary |
en
CWE-908
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| haxx | curl | * | <built-in method update of dict object at 0x7fd34b9c3280> | Application |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x7fd34b9c1040> | Operating System |
| netapp | cloud_backup | - | <built-in method update of dict object at 0x7fd3855b1840> | Application |
| netapp | clustered_data_ontap | - | <built-in method update of dict object at 0x7fd34019d740> | Application |
| netapp | hci_management_node | - | <built-in method update of dict object at 0x7fd34b9c2280> | Application |
| netapp | solidfire | - | <built-in method update of dict object at 0x7fd34b9c1000> | Application |
| apple | mac_os_x | 10.15.7 | <built-in method update of dict object at 0x7fd3401d0ac0> | Operating System |
| apple | mac_os_x | 10.15.7 | <built-in method update of dict object at 0x7fd3685307c0> | Operating System |
| apple | mac_os_x | 10.15.7 | <built-in method update of dict object at 0x7fd34019d340> | Operating System |
| apple | mac_os_x | 10.15.7 | <built-in method update of dict object at 0x7fd34b9c3680> | Operating System |
| apple | mac_os_x | 10.15.7 | <built-in method update of dict object at 0x7fd36945fb00> | Operating System |
| apple | macos | 11.0 | <built-in method update of dict object at 0x7fd34b9c31c0> | Operating System |
| apple | macos | 11.0.1 | <built-in method update of dict object at 0x7fd319c77240> | Operating System |
| apple | macos | 11.1 | <built-in method update of dict object at 0x7fd3845fe080> | Operating System |
| apple | macos | 11.1.0 | <built-in method update of dict object at 0x7fd368530f00> | Operating System |
| apple | macos | 11.2 | <built-in method update of dict object at 0x7fd34019e800> | Operating System |
| apple | macos | 11.2.1 | <built-in method update of dict object at 0x7fd34b9c1c80> | Operating System |
| apple | macos | 11.3 | <built-in method update of dict object at 0x7fd368533780> | Operating System |
| apple | macos | 11.3.1 | <built-in method update of dict object at 0x7fd368530400> | Operating System |
| apple | macos | 11.4 | <built-in method update of dict object at 0x7fd36945fd00> | Operating System |
| apple | macos | 11.5 | <built-in method update of dict object at 0x7fd2a2249240> | Operating System |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd34b9c0f40> | Application |
| oracle | mysql_server | * | <built-in method update of dict object at 0x7fd2a2249080> | Application |
| oracle | peoplesoft_enterprise_peopletools | 8.57 | <built-in method update of dict object at 0x7fd34b9c1100> | Application |
| oracle | peoplesoft_enterprise_peopletools | 8.58 | <built-in method update of dict object at 0x7fd3401d2c00> | Application |
| oracle | peoplesoft_enterprise_peopletools | 8.59 | <built-in method update of dict object at 0x7fd3854bf300> | Application |
| siemens | sinec_infrastructure_network_services | * | <built-in method update of dict object at 0x7fd2a2249bc0> | Application |
| siemens | sinema_remote_connect_server | * | <built-in method update of dict object at 0x7fd368e88ac0> | Application |
| netapp | h300s_firmware | - | <built-in method update of dict object at 0x7fd348ef06c0> | Operating System |
| netapp | h500s_firmware | - | <built-in method update of dict object at 0x7fd348ef37c0> | Operating System |
| netapp | h700s_firmware | - | <built-in method update of dict object at 0x7fd34017e480> | Operating System |
| netapp | h300e_firmware | - | <built-in method update of dict object at 0x7fd3854bf900> | Operating System |
| netapp | h500e_firmware | - | <built-in method update of dict object at 0x7fd38551f100> | Operating System |
| netapp | h700e_firmware | - | <built-in method update of dict object at 0x7fd2a2248600> | Operating System |
| netapp | h410s_firmware | - | <built-in method update of dict object at 0x7fd36afa6e00> | Operating System |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd2a224bc80> | Application |
| splunk | universal_forwarder | * | <built-in method update of dict object at 0x7fd2a224b600> | Application |
| splunk | universal_forwarder | 9.1.0 | <built-in method update of dict object at 0x7fd3401d6240> | Application |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-002:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-003:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-004:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:11.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:11.0.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:11.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:11.1.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:11.2:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:11.2.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:11.3:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:11.3.1:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:11.4:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:apple:macos:11.5:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:* |