CVE-2016-9953

The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://curl.haxx.se/CVE-2016-9952.patch	Vendor Advisory
https://curl.haxx.se/docs/adv_20161221C.html	Vendor Advisory
https://curl.haxx.se/CVE-2016-9952.patch	Vendor Advisory
https://curl.haxx.se/docs/adv_20161221C.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_embedded_compact:-:*:*:*:*:*:*:*

History

21 Nov 2024, 03:02

Type	Values Removed	Values Added
References	~~() https://curl.haxx.se/CVE-2016-9952.patch - Vendor Advisory~~	() https://curl.haxx.se/CVE-2016-9952.patch - Vendor Advisory
References	~~() https://curl.haxx.se/docs/adv_20161221C.html - Vendor Advisory~~	() https://curl.haxx.se/docs/adv_20161221C.html - Vendor Advisory

15 Dec 2023, 19:06

Type	Values Removed	Values Added
CPE	cpe:2.3:o:microsoft:windows_ce:-:::::::*	cpe:2.3:o:microsoft:windows_embedded_compact:-:::::::*
First Time		Microsoft windows Embedded Compact

Information

Published : 2018-03-12 21:29

Updated : 2024-11-21 03:02

NVD link : CVE-2016-9953

Mitre link : CVE-2016-9953

CVE.ORG link : CVE-2016-9953

JSON object : View

Products Affected

haxx

curl

microsoft

windows_embedded_compact

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2016-9953", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2018-03-12T21:29:00.563", "references": [{"url": "https://curl.haxx.se/CVE-2016-9952.patch", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://curl.haxx.se/docs/adv_20161221C.html", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://curl.haxx.se/CVE-2016-9952.patch", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://curl.haxx.se/docs/adv_20161221C.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, allows remote attackers to obtain sensitive information, cause a denial of service (crash), or possibly have unspecified other impact via a wildcard certificate name, which triggers an out-of-bounds read."}, {"lang": "es", "value": "La funci\u00f3n verify_certificate en lib/vtls/schannel.c en libcurl, desde la versi\u00f3n 7.30.0 hasta la 7.51.0, cuando se construye para Windows CE usando el backend TLS schannel, permite a los atacantes remotos obtener informaci\u00f3n sensible, causar una denegaci\u00f3n de servicio (cierre inesperado) o, posiblemente, tener otro tipo de impacto no especificado mediante un nombre de certificado wildcard, lo cual desencadena una lectura fuera de l\u00edmites."}], "lastModified": "2024-11-21T03:02:04.180", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "25ACEC30-625F-46E6-8F95-5550CEA47EF8", "versionEndIncluding": "7.51.0", "versionStartIncluding": "7.30.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_embedded_compact:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "48927A5E-B938-4D59-84E1-4C05AA80F69C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}