CVE-2009-0037

Published: Mar 5, 2009Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

Affected (80)

Products: Curl: Curl, Libcurl

Curl

2 products

Curl

Libcurl

Configuration A

80 vulnerable

Vulnerable Software	Affected Versions
Curl Curl	Version 5.11
Curl Curl	Version 6.0
Curl Curl	Version 6.1beta
Curl Curl	Version 6.2
Curl Curl	Version 6.3.1
Curl Curl	Version 6.3
Curl Curl	Version 6.4
Curl Curl	Version 6.5.1
Curl Curl	Version 6.5.2
Curl Curl	Version 6.5
Curl Curl	Version 7.1.1
Curl Curl	Version 7.10.1
Curl Curl	Version 7.10.2
Curl Curl	Version 7.10.3
Curl Curl	Version 7.10.4
Curl Curl	Version 7.10.5
Curl Curl	Version 7.10.6
Curl Curl	Version 7.10.7
Curl Curl	Version 7.10.8
Curl Curl	Version 7.10
Curl Curl	Version 7.11.1
Curl Curl	Version 7.12.1
Curl Curl	Version 7.12.2
Curl Curl	Version 7.12
Curl Curl	Version 7.13.2
Curl Curl	Version 7.13
Curl Curl	Version 7.14.1
Curl Curl	Version 7.14
Curl Curl	Version 7.15.1
Curl Curl	Version 7.15.3
Curl Curl	Version 7.15
Curl Curl	Version 7.16.3
Curl Curl	Version 7.16.4
Curl Curl	Version 7.17
Curl Curl	Version 7.18
Curl Curl	Version 7.19.3
Curl Curl	Version 7.1
Curl Curl	Version 7.2.1
Curl Curl	Version 7.2
Curl Curl	Version 7.3
Curl Curl	Version 7.4.1
Curl Curl	Version 7.4.2
Curl Curl	Version 7.4
Curl Curl	Version 7.5.1
Curl Curl	Version 7.5.2
Curl Curl	Version 7.5
Curl Curl	Version 7.6.1
Curl Curl	Version 7.6
Curl Curl	Version 7.7.1
Curl Curl	Version 7.7.2
Curl Curl	Version 7.7.3
Curl Curl	Version 7.7
Curl Curl	Version 7.8.1
Curl Curl	Version 7.8.2
Curl Curl	Version 7.8
Curl Curl	Version 7.9.1
Curl Curl	Version 7.9.2
Curl Curl	Version 7.9.3
Curl Curl	Version 7.9.4
Curl Curl	Version 7.9.5
Curl Curl	Version 7.9.6
Curl Curl	Version 7.9.7
Curl Curl	Version 7.9.8
Curl Curl	Version 7.9
Curl Libcurl	Version 5.11
Curl Libcurl	Version 7.12.1
Curl Libcurl	Version 7.12.2
Curl Libcurl	Version 7.12.3
Curl Libcurl	Version 7.12
Curl Libcurl	Version 7.13.1
Curl Libcurl	Version 7.13.2
Curl Libcurl	Version 7.13
Curl Libcurl	Version 7.14.1
Curl Libcurl	Version 7.14
Curl Libcurl	Version 7.15.1
Curl Libcurl	Version 7.15.2
Curl Libcurl	Version 7.15.3
Curl Libcurl	Version 7.15
Curl Libcurl	Version 7.16.3
Curl Libcurl	Version 7.19.3

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (64)

http://curl.haxx.se/docs/adv_20090303.html

Source: secalert@redhat.com

PatchVendor Advisory

http://curl.haxx.se/lxr/source/CHANGES

Source: secalert@redhat.com

PatchVendor Advisory

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html

Source: secalert@redhat.com

http://lists.vmware.com/pipermail/security-announce/2009/000060.html

Source: secalert@redhat.com

http://secunia.com/advisories/34138

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/34202

Source: secalert@redhat.com

http://secunia.com/advisories/34237

Source: secalert@redhat.com

http://secunia.com/advisories/34251

Source: secalert@redhat.com

http://secunia.com/advisories/34255

Source: secalert@redhat.com

http://secunia.com/advisories/34259

Source: secalert@redhat.com

http://secunia.com/advisories/34399

Source: secalert@redhat.com

http://secunia.com/advisories/35766

Source: secalert@redhat.com

http://security.gentoo.org/glsa/glsa-200903-21.xml

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.476602

Source: secalert@redhat.com

http://support.apple.com/kb/HT4077

Source: secalert@redhat.com

http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0042

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1738

Source: secalert@redhat.com

http://www.redhat.com/support/errata/RHSA-2009-0341.html

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/501757/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/504849/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/33962

Source: secalert@redhat.com

ExploitPatch

http://www.securitytracker.com/id?1021783

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-726-1

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2009-0009.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/0581

Source: secalert@redhat.com

PatchVendor Advisory

http://www.vupen.com/english/advisories/2009/1865

Source: secalert@redhat.com

http://www.withdk.com/2009/03/03/curllibcurl-redirect-arbitrary-file-access/

Source: secalert@redhat.com

http://www.withdk.com/archives/Libcurl_arbitrary_file_access.pdf

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/49030

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11054

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6074

Source: secalert@redhat.com

http://curl.haxx.se/docs/adv_20090303.html