IBM SECURITY ADVISORY
First Issued: Mon Nov 1 12:25:23 CDT 2021
The most recent version of this document is available here:
http://aix.software.ibm.com/aix/efixes/powersc/security/curl_advisory7.asc
https://aix.software.ibm.com/aix/efixes/powersc/security/curl_advisory7.asc
ftp://aix.software.ibm.com/aix/efixes/powersc/security/curl_advisory7.asc
Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC
===============================================================================
SUMMARY:
There are multiple vulnerabilities in Curl that affect PowerSC.
===============================================================================
VULNERABILITY DETAILS:
CVEID: CVE-2021-22897
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22897
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22897
DESCRIPTION: cURL libcurl could allow a remote attacker to obtain
sensitive information, caused by a mistake in the code for
CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS
library. An attacker could exploit this vulnerability to expose data
element to wrong session.
CVSS Base score: 3.7
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/203609
for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVEID: CVE-2021-22922
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22922
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22922
DESCRIPTION: cURL libcurl could allow a remote attacker to bypass security
restrictions, caused by not removing incorrect content by the metalink
feature. By persuading a victim to download specially-crafted content,
an attacker could exploit this vulnerability to access malicious
content to keep in the file on disk for further attack.
CVSS Base score: 7.8
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/206045
for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVEID: CVE-2021-22901
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22901
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22901
DESCRIPTION: cURL libcurl could allow a remote attacker to execute
arbitrary code on the system, caused by a flaw when a new TLS session
is negotiated or a client certificate is requested on an existing
connection. By persuading a victim to visit a specially-crafted Web
site, an attacker could exploit this vulnerability to execute
arbitrary code on the system.
CVSS Base score: 8.8
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/202563
for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
CVEID: CVE-2021-22898
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22898
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22898
DESCRIPTION: cURL libcurl could allow a remote attacker to obtain
sensitive information, caused by a flaw in the option parser for
sending NEW_ENV variables. By sending a specially-crafted request
using a clear-text network protocol, an attacker could exploit this
vulnerability to obtain sensitive internal information to the server,
and use this information to launch further attacks against the
affected system.
CVSS Base score: 7.5
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/202562
for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVEID: CVE-2021-22945
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22945
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22945
DESCRIPTION: cURL libcurl is vulnerable to a denial of service, caused by
a use-after-free and double free flaw when sending data to an MQTT
server. By sending a specially-crafted data, a remote attacker could
exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/209451
for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVEID: CVE-2021-22924
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22924
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22924
DESCRIPTION: An unspecified error with bad connection reused due to
improper path name validation in cURL libcurl has an unknown impact
and attack vector.
CVSS Base score: 5.3
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/206047
for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
CVEID: CVE-2021-22925
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22925
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22925
DESCRIPTION: cURL libcurl could allow a remote attacker to obtain
sensitive information, caused by a flaw in the option parser for
sending NEW_ENV variables. By sniffing the network traffic, an
attacker could exploit this vulnerability to obtain TELNET stack
contents, and use this information to launch further attacks against
the affected system.
CVSS Base score: 6.5
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/206051
for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVEID: CVE-2021-22923
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22923
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22923
DESCRIPTION: cURL libcurl could allow a remote attacker to obtain
sensitive information, caused by improper protection to user
credentials by the metalink feature. By persuading a victim to connect
a specially-crafted server, an attacker could exploit this
vulnerability to obtain user credentials, and use this information to
launch further attacks against the affected system.
CVSS Base score: 6.5
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/206046
for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
CVEID: CVE-2021-22947
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22947
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22947
DESCRIPTION: cURL libcurl is vulnerable to a man-in-the-middle attack,
caused by a flaw when connecting to an IMAP, POP3, SMTP or FTP server
to exchange data securely using STARTTLS to upgrade the connection to
TLS level. An attacker could exploit this vulnerability to launch a
man-in-the-middle attack and gain access to the communication channel
between endpoints to obtain sensitive information or further
compromise the system.
CVSS Base score: 7.4
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/209453
for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
CVEID: CVE-2021-22946
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22946
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22946
DESCRIPTION: cURL libcurl could allow a remote attacker to obtain
sensitive information, caused by a required TLS bypassed issue. By
sniffing the network, an attacker could exploit this vulnerability to
obtain sensitive data in clear text over the network, and use this
information to launch further attacks against the affected system.
CVSS Base score: 7.5
CVSS Temporal Score: See:
https://exchange.xforce.ibmcloud.com/vulnerabilities/209452
for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
AFFECTED PRODUCTS AND VERSIONS:
PowerSC 1.3
PowerSC 2.0
The vulnerabilities in the following filesets are being addressed:
key_fileset = powerscStd.tnc_pm
key_fileset = curl-7.79.1-1.aix6.1.ppc.rpm
Fileset Lower Level Upper Level KEY
---------------------------------------------------------------
powerscStd.tnc_pm 1.3.0.4 2.0.0.1 key_w_fs
curl-7.79.1-1.aix6.1.ppc.rpm 7.19.4 7.79.0 key_w_fs
Note: To find out whether the affected PowerSC filesets are installed
on your systems, refer to the lslpp command found in AIX user's guide.
To find out whether the affected curl filesets are installed on your
systems, refer to the rpm command found in AIX user's guide.
Example: lslpp -l | grep powerscStd
Example: rpm -qa | grep curl
REMEDIATION:
A. FIXES
Fixes are available.
The fixes can be downloaded via ftp or http from:
ftp://aix.software.ibm.com/aix/efixes/powersc/security/curl_fix7.tar
http://aix.software.ibm.com/aix/efixes/powersc/security/curl_fix7.tar
https://aix.software.ibm.com/aix/efixes/powersc/security/curl_fix7.tar
The link above is to a tar file containing this signed
advisory, open source fix packages, and OpenSSL signatures for each
package.
To extract the fixes from the tar file:
tar xvf curl_fix7.tar
cd curl_fix7
Verify you have retrieved the fixes intact:
The checksums below were generated using the
"openssl dgst -sha256 <filename>" command as the following:
openssl dgst -sha256 filename KEY
------------------------------------------------------------------------------------------------------------------------
414c3eea7271004de03fc5bb84e7c0272068bd990cdc81992f074607916f605a curl-7.79.1-1.aix6.1.ppc.rpm key_w_csum
These sums should match exactly. The OpenSSL signatures in the tar
file and on this advisory can also be used to verify the
integrity of the fixes. If the sums or signatures cannot be
confirmed, contact IBM Support.
openssl dgst -sha256 -verify <pubkey_file> -signature <advisory_file>.sig <advisory_file>
openssl dgst -sha256 -verify <pubkey_file> -signature <ifix_file>.sig <ifix_file>
Published advisory OpenSSL signature file location:
http://aix.software.ibm.com/aix/efixes/powersc/security/curl_advisory7.asc.sig
https://aix.software.ibm.com/aix/efixes/powersc/security/curl_advisory7.asc.sig
ftp://aix.software.ibm.com/aix/efixes/powersc/security/curl_advisory7.asc.sig
B. FIX AND INTERIM FIX INSTALLATION
IMPORTANT: If possible, it is recommended that a mksysb backup
of the system be created. Verify it is both bootable and
readable before proceeding.
To extract the fixes from the tar file:
tar xvf curl_fix7.tar
cd curl_fix7
To install a fix package:
rpm -ivh *.rpm
rpm -Uvh *.rpm
Interim fixes have had limited functional and regression
testing but not the full regression testing that takes place
for Service Packs; however, IBM does fully support them.
WORKAROUNDS AND MITIGATIONS:
None.
===============================================================================
CONTACT US:
Note: Keywords labeled as KEY in this document are used for parsing
purposes.
If you would like to receive PowerSC Security Advisories via email,
please visit "My Notifications":
http://www.ibm.com/support/mynotifications
https://www.ibm.com/support/mynotifications
To view previously issued advisories, please visit:
http://www14.software.ibm.com/webapp/set2/subscriptions/onvdq
https://www14.software.ibm.com/webapp/set2/subscriptions/onvdq
Contact IBM Support for questions related to this announcement:
http://ibm.com/support/
https://ibm.com/support/
To obtain the OpenSSL public key that can be used to verify the
signed advisories and ifixes:
Download the key from our web page:
ftp://ftp.software.ibm.com/systems/power/AIX/systems_p_os_aix_security_pubkey.txt
Please contact your local IBM AIX support center for any
assistance.
REFERENCES:
Complete CVSS v3 Guide: http://www.first.org/cvss/user-guide
https://www.first.org/cvss/user-guide
On-line Calculator v3:
http://www.first.org/cvss/calculator/3.0
https://www.first.org/cvss/calculator/3.0
ACKNOWLEDGEMENTS:
None.
CHANGE HISTORY:
First Issued: Mon Nov 1 12:25:23 CDT 2021
===============================================================================
*The CVSS Environment Score is customer environment specific and will
ultimately impact the Overall CVSS Score. Customers can evaluate the impact
of this vulnerability in their environments by accessing the links in the
Reference section of this Security Bulletin.
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the
Common Vulnerability Scoring System (CVSS) is an "industry open standard
designed to convey vulnerability severity and help to determine urgency and
priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY
OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT
OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.