bugtraq - [ MDVSA-2014:110 ] curl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 10 Jun 2014 11:14:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2014:110 ] curl

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2014:110
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : curl
 Date    : June 10, 2014
 Affected: Business Server 1.0, Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Updated curl packages fix security vulnerabilities:
 
 Paras Sethia discovered that libcurl would sometimes mix up multiple
 HTTP and HTTPS connections with NTLM authentication to the same server,
 sending requests for one user over the connection authenticated as
 a different user (CVE-2014-0015).
 
 libcurl can in some circumstances re-use the wrong connection when
 asked to do transfers using other protocols than HTTP and FTP, causing
 a transfer that was initiated by an application to wrongfully re-use
 an existing connection to the same server that was authenticated
 using different credentials (CVE-2014-0138).
 
 libcurl incorrectly validates wildcard SSL certificates containing
 literal IP addresses, so under certain conditions, it would allow
 and use a wildcard match specified in the CN field, allowing a
 malicious server to participate in a MITM attack or just fool users
 into believing that it is a legitimate site (CVE-2014-0139).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0015
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139
 http://advisories.mageia.org/MGASA-2014-0153.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Enterprise Server 5:
 dbfc65c19ac0479b0f171fb2f57b7009  mes5/i586/curl-7.19.0-2.9mdvmes5.2.i586.rpm
 329ea6986634f8115f0f40189dafa13d  mes5/i586/curl-examples-7.19.0-2.9mdvmes5.2.i586.rpm
 e90929468892b409168cbaaf5ccf7aa7  mes5/i586/libcurl4-7.19.0-2.9mdvmes5.2.i586.rpm
 b76ba081a80e5305b3ea502331d339f1  mes5/i586/libcurl-devel-7.19.0-2.9mdvmes5.2.i586.rpm 
 079bba263ad5eba412c40e97b088ff49  mes5/SRPMS/curl-7.19.0-2.9mdvmes5.2.src.rpm

 Mandriva Enterprise Server 5/X86_64:
 d51a98de165924c8eb83db16cd2a9de1  mes5/x86_64/curl-7.19.0-2.9mdvmes5.2.x86_64.rpm
 2d6dba13c1b95fe669eeee6ef618e6d2  mes5/x86_64/curl-examples-7.19.0-2.9mdvmes5.2.x86_64.rpm
 3e92dcf0f85218afd68cdf12b81b7639  mes5/x86_64/lib64curl4-7.19.0-2.9mdvmes5.2.x86_64.rpm
 035cea9d1c4d9f30e442113c1890da29  mes5/x86_64/lib64curl-devel-7.19.0-2.9mdvmes5.2.x86_64.rpm 
 079bba263ad5eba412c40e97b088ff49  mes5/SRPMS/curl-7.19.0-2.9mdvmes5.2.src.rpm

 Mandriva Business Server 1/X86_64:
 59896a7f65dc52adff833b191c2ccd8d  mbs1/x86_64/curl-7.24.0-3.5.mbs1.x86_64.rpm
 c519acfcdfd464dce34e5d85642cddae  mbs1/x86_64/curl-examples-7.24.0-3.5.mbs1.x86_64.rpm
 c9c4ccf43b0115c3faf24ae6c0a4ef51  mbs1/x86_64/lib64curl4-7.24.0-3.5.mbs1.x86_64.rpm
 9d8d2a5cbffd1ba844d1a6c7837f2298  mbs1/x86_64/lib64curl-devel-7.24.0-3.5.mbs1.x86_64.rpm 
 9dbb683a4ebda2ad649562fd66c9cb87  mbs1/SRPMS/curl-7.24.0-3.5.mbs1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTlqBfmqjQ0CJFipgRAnnBAJ4iIKbK1jBxAtipngM1xlSflmpTUQCgsxIE
SB5lxqgllGcXWEW9SyPo/Fw=
=hggz
-----END PGP SIGNATURE-----