PT-2015-6074 · Canonical+9 · Ubuntu+10

Paras Sethia · Published 2015-04-22 · Updated 2024-06-15 · CVE-2015-3143

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cURL and libcurl versions 7.10.6 through 7.41.0 libcurl (affected versions not specified) in apple mac os x, canonical ubuntu linux, debian debian linux, hp system management homepage

Description The issue is related to the improper re-use of NTLM connections, allowing remote attackers to connect as other users via an unauthenticated request. This is similar to a previously known issue.

Recommendations For cURL and libcurl versions 7.10.6 through 7.41.0: update to a version that properly handles NTLM connections to prevent unauthorized access. For libcurl in apple mac os x, canonical ubuntu linux, debian debian linux, hp system management homepage: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-305

CWE-264

Related Identifiers

ALT-PU-2015-1396

CESA-2015_1254

CESA-2015_2159

CVE-2015-3143

DLA-211-1

DSA-3232-1

MGASA-2015-0179

OPENSUSE-SU-2024:10303-1

RHSA-2015:1254

RHSA-2015:2159

RHSA-2015_1254

RHSA-2015_2159

SUSE-SU-2015:0962-1

SUSE-SU-2015:0990-1

SUSE-SU-2015_0962-1

SUSE-SU-2015_0990-1

USN-2591-1

Affected Products

Alt Linux

Centos

Debian

Junos

Red Hat

Suse

Hp System Management Homepage

Ubuntu

Curl

Libcurl

Apple Macos

References · 86

• https://ubuntu.com/security/CVE-2015-3145 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html · Vendor Advisory
• https://debian.org/security/2015/dsa-3232 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3153 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html · Vendor Advisory
• https://security.gentoo.org/glsa/201509-02 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0179 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:0990-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:220 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3232-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:219 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2591-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-3143 · Security Note
• https://osv.dev/vulnerability/CURL-CVE-2015-3143 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html · Vendor Advisory