PT-2015-6080 · Curl+4 · Libcurl+4

Oren Souroujon + 1 · Published 2015-04-29 · Updated 2024-06-15 · CVE-2015-3153

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions libcurl versions prior to 7.42.1

Description The issue arises from the default configuration of libcurl, where custom HTTP headers are sent to both the proxy and destination server. This might allow remote proxy servers to obtain sensitive information by reading the header contents. The problem occurs when the connection passes through an HTTP proxy, and the same set of headers is sent to the proxy as well by default. This can happen when using the HTTPS protocol or when explicitly asked for, and the initial connection to the proxy is made in clear, including any custom headers using the HTTP CONNECT method. If an application sets a custom HTTP header with sensitive content, such as authentication cookies, without changing the default, the proxy and anyone who listens to the traffic between the application and the proxy might get access to those values.

Recommendations For libcurl versions prior to 7.42.1, consider using the CURLOPT HEADEROPT option to tell libcurl to send separate lists of headers to the different destinations, or update to version 7.42.1 or later. As a temporary workaround, consider avoiding the use of custom HTTP headers with sensitive content or using the CURLOPT COOKIE option, which is always sent only to the destination server.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-201

Related Identifiers

ALT-PU-2015-1410

CVE-2015-3153

DSA-3240-1

OPENSUSE-SU-2024:10303-1

SUSE-SU-2015:0962-1

SUSE-SU-2015:0990-1

USN-2591-1

Affected Products

Alt Linux

Junos

Suse

Ubuntu

Libcurl

References · 79

• https://ubuntu.com/security/CVE-2015-3144 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3145 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3153 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-3153 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3148 · Security Note
• https://osv.dev/vulnerability/USN-2591-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-3153 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3144 · Security Note
• http://curl.haxx.se/docs/adv_20150429.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/curl · Vendor Advisory
• https://osv.dev/vulnerability/CURL-CVE-2015-3153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3153 · Security Note
• http://debian.org/security/2015/dsa-3240 · Vendor Advisory
• http://oracle.com/technetwork/topics/security/cpuoct2015-2367953.html · Patch
• https://osv.dev/vulnerability/DSA-3240-1 · Vendor Advisory