How to upgrade libcurl package in centos 6

Lundz · Sep 25, 2014

Hello

By default centos 6 uses libcurl 7.19 i would like to upgrade that to the newest possible but how would be the best way?

eva2000 · Sep 25, 2014

Unfortuntaely curl and libcurl are deeply embedded into the system with some other software depending on those version numbers. So it's more difficult to replace the version of curl/libcurl provided by Redhat or CentOS (not impossible as I have a few systems using curl and libcurl 7.38). But it's best to wait for upstream released packages for curl and libcurl. FYI, Redhat and CentOS backport patch updates from newer 7.38 into 7.19 via incrementing number at end of 7.19.*.

You can check the change logs
Code:
rpm -qa --changelog libcurl | head -n10
* Mon May 19 2014 Kamil Dudka <kdudka@redhat.com> 7.19.7-37.el6_5.3
- fix re-use of wrong HTTP NTLM connection (CVE-2014-0015)
- fix connection re-use when using different log-in credentials (CVE-2014-0138)

* Mon May 12 2014 Kamil Dudka <kdudka@redhat.com> 7.19.7-37.el6_5.2
- fix authentication failure when server offers multiple auth options (#1096797)

* Fri Apr 25 2014 Kamil Dudka <kdudka@redhat.com> 7.19.7-37.el6_5.1
- refresh expired cookie in test172 from upstream test-suite (#1092486)
- fix a memory leak caused by write after close (#1092479)
Code:
rpm -qa --changelog curl | head -n10
* Mon May 19 2014 Kamil Dudka <kdudka@redhat.com> 7.19.7-37.el6_5.3
- fix re-use of wrong HTTP NTLM connection (CVE-2014-0015)
- fix connection re-use when using different log-in credentials (CVE-2014-0138)

* Mon May 12 2014 Kamil Dudka <kdudka@redhat.com> 7.19.7-37.el6_5.2
- fix authentication failure when server offers multiple auth options (#1096797)

* Fri Apr 25 2014 Kamil Dudka <kdudka@redhat.com> 7.19.7-37.el6_5.1
- refresh expired cookie in test172 from upstream test-suite (#1092486)
- fix a memory leak caused by write after close (#1092479)
If you are referring to the curl vulnerabilities CVE-2014-3613 and CVE-2014-3620, just be aware the later is not affected in Redhat or CentOS versions 5, 6 and 7 and you need to wait for an update to be available for Redhat or CentOS for CVE-2014-3613 which is related to libcurl cookie leak with IP address as domain. Bug report for CVE-2014-3613 is located here.

CVE-2014-3613

This issue affects the versions of curl as shipped with Red Hat Enterprise Linux 5, 6, and 7. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: Issue Severity Classification - Red Hat Customer Portal
Click to expand...

libcurl cookie leak with IP address as domain

VULNERABILITY

By not detecting and rejecting domain names for partial literal IP addresses
properly when parsing received HTTP cookies, libcurl can be fooled to both
sending cookies to wrong sites and into allowing arbitrary sites to set
cookies for others.

For this problem to trigger, the client application must use the numerical
IP address in the URL to access the site and the site must send back cookies
to the site using domain= and a partial IP address.

Since libcurl wrongly approaches the IP address like it was a normal domain
name, a site at IP address 192.168.0.1 can set cookies for anything ending
with .168.0.1 thus fooling libcurl to send them also to for example
127.168.0.1.

The flaw requires dots to be present in the IP address, which restricts the
flaw to IPv4 literal addresses or IPv6 addresses using the somewhat unusual
"dotted-quad" style: "::ffff:192.0.2.128"

This is not believed to be done by typical sites as this is not supported by
clients that adhere to the rules of the RFC 6265, and many sites are written
to explicitly use their own specific named domain when sending cookies.

2. INFO

Cookie parsing and use is opt-in by applications and is not enabled by
default.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CVE-2014-3613 to this issue.

3. AFFECTED VERSIONS

The IP address flaw has existed ever since libcurl started to support
cookies.

Affected versions: from libcurl 7.1 to and including 7.37.1
Not affected versions: libcurl >= 7.38.0

libcurl is used by many applications, but not always advertised as such!
Click to expand...

eva2000 · Sep 25, 2014

More plain English explanation of CVE-2014-3613

This issue can affect applications using curl if they enabled cookie support and are used to access HTTP/HTTPS servers using IP address rather than host name. To take advantage of the problem, attacker needs to trick victim into connecting to their malicious server using its IP address. The IP of the malicious server must have the last two or three octets of it match relevant octets of a non-malicious server IP victim normally connects to (i.e. using example from comment 0, if victim normally connects to 192.168.0.1, attack's malicious server must use an IP ending with 168.0.1 or 0.1). In such case, attacker's server can send cookies with crafted 'domain' attribute that will be sent to the target server.

This can provide an attacker with a way to exploit other cookie handling bugs on the target server (e.g. session fixation issues, or other issues related to improper sanitization of cookie values).

It does not seem this issue can lead to leak of cookies in any reasonable use case. A non-malicious server would have to incorrectly set 'domain' attributes on cookies it returns to risk their expose to other servers.
Click to expand...

Log in / Register

Forums

Discover Centmin Mod today

How to upgrade libcurl package in centos 6

Lundz Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Discover Centmin Mod today

How to upgrade libcurl package in centos 6

Lundz Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

.