CVE-2016-9952 Security feature bypass in n/a
Attackers can bypass certificate validation in libcurl on Windows CE via crafted wildcard SANs, enabling man-in-the-middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-9952?
CVE-2016-9952 is a high-severity vulnerability in Haxx Curl, published on 12 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The verify_certificate function in lib/vtls/schannel.c in libcurl 7.30.0 through 7.51.0, when built for Windows CE using the schannel TLS backend, makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted wildcard SAN in a server certificate, as demonstrated by "*.com."
Weakness: CWE-295
Which versions are affected by CVE-2016-9952?
It affects 1 product.
Products include Haxx Curl.
How do I fix CVE-2016-9952?
Upgrade to a fixed version.
Is CVE-2016-9952 being exploited?
There is no known exploitation of CVE-2016-9952 in the wild and no public exploit code.
Other vulnerabilities in Haxx Curl
Sources
Also known as ALPINE-CVE-2016-9952, CURL-CVE-2016-9952, GHSA-j357-mfhx-p456.