bugtraq - [ MDVSA-2015:098 ] curl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-Id: <E1Ybobt-0005Kj-13@titan.mandriva.com>
Date: Sat, 28 Mar 2015 12:09:01 +0100
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2015:098 ] curl

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:098
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : curl
 Date    : March 28, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Updated curl packages fix security vulnerabilities:
 
 Paras Sethia discovered that libcurl would sometimes mix up multiple
 HTTP and HTTPS connections with NTLM authentication to the same server,
 sending requests for one user over the connection authenticated as
 a different user (CVE-2014-0015).
 
 libcurl can in some circumstances re-use the wrong connection when
 asked to do transfers using other protocols than HTTP and FTP, causing
 a transfer that was initiated by an application to wrongfully re-use
 an existing connection to the same server that was authenticated
 using different credentials (CVE-2014-0138).
 
 libcurl incorrectly validates wildcard SSL certificates containing
 literal IP addresses, so under certain conditions, it would allow
 and use a wildcard match specified in the CN field, allowing a
 malicious server to participate in a MITM attack or just fool users
 into believing that it is a legitimate site (CVE-2014-0139).
 
 In cURL before 7.38.0, libcurl can be fooled to both sending cookies
 to wrong sites and into allowing arbitrary sites to set cookies for
 others. For this problem to trigger, the client application must use
 the numerical IP address in the URL to access the site (CVE-2014-3613).
 
 In cURL before 7.38.0, libcurl wrongly allows cookies to be set for Top
 Level Domains (TLDs), thus making them apply broader than cookies are
 allowed. This can allow arbitrary sites to set cookies that then would
 get sent to a different and unrelated site or domain (CVE-2014-3620).
 
 Symeon Paraschoudis discovered that the curl_easy_duphandle() function
 in cURL has a bug that can lead to libcurl eventually sending off
 sensitive data that was not intended for sending, while performing
 a HTTP POST operation. This bug requires CURLOPT_COPYPOSTFIELDS and
 curl_easy_duphandle() to be used in that order, and then the duplicate
 handle must be used to perform the HTTP POST. The curl command line
 tool is not affected by this problem as it does not use this sequence
 (CVE-2014-3707).
 
 When libcurl sends a request to a server via a HTTP proxy, it copies
 the entire URL into the request and sends if off. If the given URL
 contains line feeds and carriage returns those will be sent along to
 the proxy too, which allows the program to for example send a separate
 HTTP request injected embedded in the URL (CVE-2014-8150).
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0015
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3613
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3620
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3707
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8150
 http://advisories.mageia.org/MGASA-2014-0153.html
 http://advisories.mageia.org/MGASA-2014-0385.html
 http://advisories.mageia.org/MGASA-2014-0444.html
 http://advisories.mageia.org/MGASA-2015-0020.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 2/X86_64:
 498d59be3a6a4ace215c0d98fb4abede  mbs2/x86_64/curl-7.34.0-3.1.mbs2.x86_64.rpm
 75a821b73a75ca34f1747a0f7479267f  mbs2/x86_64/curl-examples-7.34.0-3.1.mbs2.noarch.rpm
 f5d3aad5f0fd9db68b87c648aaabbb4a  mbs2/x86_64/lib64curl4-7.34.0-3.1.mbs2.x86_64.rpm
 4f356a2c97f9f64124b4e8ebe307826a  mbs2/x86_64/lib64curl-devel-7.34.0-3.1.mbs2.x86_64.rpm 
 d010a357d76a8eb967c7c52f92fb35ae  mbs2/SRPMS/curl-7.34.0-3.1.mbs2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVFn3GmqjQ0CJFipgRAu1CAJ9iEOw8vZuH/tA8vyx1xmbC4vySTgCgqExY
Fpa5OZRsP4i0DWRwsyxOCt4=
=5PNM
-----END PGP SIGNATURE-----