CVE-2009-0037

Public Exploit

Description

The redirect implementation in curl and libcurl 5.11 through 7.19.3, when CURLOPT_FOLLOWLOCATION is enabled, accepts arbitrary Location values, which might allow remote HTTP servers to (1) trigger arbitrary requests to intranet servers, (2) read or overwrite arbitrary files via a redirect to a file: URL, or (3) execute arbitrary commands via a redirect to an scp: URL.

Category

6.8
CVSS
Severity: Medium
CVSS 2.0 •
EPSS 1.20% Top 25%
Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory apple.com Vendor Advisory opensuse.org Vendor Advisory slackware.com Vendor Advisory gentoo.org Vendor Advisory haxx.se Vendor Advisory haxx.se Vendor Advisory secunia.com Vendor Advisory vupen.com
Affected: n/a n/a
Published at:
Updated at:

References

Link Tags
http://www.ubuntu.com/usn/USN-726-1 vendor advisory
http://secunia.com/advisories/34259 third party advisory
http://curl.haxx.se/lxr/source/CHANGES patch vendor advisory
http://secunia.com/advisories/35766 third party advisory
http://secunia.com/advisories/34255 third party advisory
http://www.redhat.com/support/errata/RHSA-2009-0341.html vendor advisory
http://www.debian.org/security/2009/dsa-1738 vendor advisory
http://www.withdk.com/2009/03/03/curllibcurl-redirect-arbitrary-file-access/
https://exchange.xforce.ibmcloud.com/vulnerabilities/49030 vdb entry
http://www.vupen.com/english/advisories/2009/1865 vdb entry
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html vendor advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2009-0042
http://lists.opensuse.org/opensuse-security-announce/2009-03/msg00001.html vendor advisory
http://secunia.com/advisories/34138 third party advisory vendor advisory
http://curl.haxx.se/docs/adv_20090303.html patch vendor advisory
http://secunia.com/advisories/34202 third party advisory
http://www.securityfocus.com/archive/1/501757/100/0/threaded mailing list
http://www.vupen.com/english/advisories/2009/0581 vdb entry patch vendor advisory
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.476602 vendor advisory
http://lists.vmware.com/pipermail/security-announce/2009/000060.html mailing list
http://www.securityfocus.com/bid/33962 exploit vdb entry patch
http://support.apple.com/kb/HT4077
http://www.withdk.com/archives/Libcurl_arbitrary_file_access.pdf
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11054 vdb entry signature
http://security.gentoo.org/glsa/glsa-200903-21.xml vendor advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6074 vdb entry signature
http://www.securitytracker.com/id?1021783 vdb entry
http://secunia.com/advisories/34251 third party advisory
http://secunia.com/advisories/34399 third party advisory
http://www.securityfocus.com/archive/1/504849/100/0/threaded mailing list
http://secunia.com/advisories/34237 third party advisory
http://www.vmware.com/security/advisories/VMSA-2009-0009.html

Frequently Asked Questions

What is the severity of CVE-2009-0037?
CVE-2009-0037 has been scored as a medium severity vulnerability.
How to fix CVE-2009-0037?
To fix CVE-2009-0037, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2009-0037 being actively exploited in the wild?
It is possible that CVE-2009-0037 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.