PT-2014-1829 · Curl+5 · Libcurl+6

Published 2014-01-29 · Updated 2024-06-15 · CVE-2014-0015

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cURL and libcurl versions 7.10.6 through 7.34.0

Description The issue allows context-dependent attackers to authenticate as other users via a request when more than one authentication method is enabled, and NTLM connections are re-used. This can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of this issue can be done remotely.

Recommendations For versions 7.10.6 through 7.34.0, to mitigate this problem, applications can disable libcurl's re-use of connections by using one of the following libcurl options: CURLOPT FRESH CONNECT, CURLOPT MAXCONNECTS, or CURLMOPT MAX HOST CONNECTIONS (if using the curl multi API).

Fix

Improper Authentication

Weakness Enumeration

CWE-287

CWE-305

Related Identifiers

ALT-PU-2014-1107

BDU:2015-06304

BDU:2015-06305

BDU:2015-09087

BDU:2015-09088

CESA-2014_0561

CVE-2014-0015

DSA-2849-1

MGASA-2014-0153

OPENSUSE-SU-2024:10303-1

RHSA-2014:0561

RHSA-2014_0561

SUSE-SU-2014_0171-1

SUSE-SU-2014_0175-1

SUSE-SU-2014_0175-2

SUSE-SU-2015:0962-1

Affected Products

Alt Linux

Centos

Junos

Red Hat

Suse

Curl

Libcurl

References · 75

• https://osv.dev/vulnerability/CURL-CVE-2014-0015 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0153 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127627.html · Vendor Advisory
• http://secunia.com/advisories/56734 · Vendor Advisory
• http://debian.org/security/2014/dsa-2849 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0153.html · Security Note
• https://bdu.fstec.ru/vul/2015-06304 · Security Note
• http://secunia.com/advisories/56728 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128408.html · Vendor Advisory
• http://curl.haxx.se/docs/adv_20140129.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0015 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09087 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-0015 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10303-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-0015 · Vendor Advisory