bugtraq - [SECURITY] [DSA 3232-1] curl security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20150422120834.0E49E20D@bendel.debian.org>
Date: Wed, 22 Apr 2015 14:08:24 +0200
From: Alessandro Ghedini <ghedo@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3232-1] curl security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3232-1                   security@...ian.org
http://www.debian.org/security/                        Alessandro Ghedini
April 22, 2015                         http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : curl
CVE ID         : CVE-2015-3143 CVE-2015-3144 CVE-2015-3145 CVE-2015-3148

Several vulnerabilities were discovered in cURL, an URL transfer library:

CVE-2015-3143

    NTLM-authenticated connections could be wrongly reused for requests
    without any credentials set, leading to HTTP requests being sent
    over the connection authenticated as a different user. This is
    similar to the issue fixed in DSA-2849-1.

CVE-2015-3144

    When parsing URLs with a zero-length hostname (such as "http://:80"),
    libcurl would try to read from an invalid memory address. This could
    allow remote attackers to cause a denial of service (crash). This
    issue only affects the upcoming stable (jessie) and unstable (sid)
    distributions.

CVE-2015-3145

    When parsing HTTP cookies, if the parsed cookie's "path" element
    consists of a single double-quote, libcurl would try to write to an
    invalid heap memory address. This could allow remote attackers to
    cause a denial of service (crash). This issue only affects the
    upcoming stable (jessie) and unstable (sid) distributions.

CVE-2015-3148

    When doing HTTP requests using the Negotiate authentication method
    along with NTLM, the connection used would not be marked as
    authenticated, making it possible to reuse it and send requests for
    one user over the connection authenticated as a different user.

For the stable distribution (wheezy), these problems have been fixed in
version 7.26.0-1+wheezy13.

For the upcoming stable distribution (jessie), these problems have been
fixed in version 7.38.0-4+deb8u1.

For the unstable distribution (sid), these problems have been fixed in
version 7.42.0-1.

We recommend that you upgrade your curl packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJVN484AAoJEK+lG9bN5XPL5isP/2PLo2iCsaKPAl4FCMC7G8uj
D3WJgAx3dID1+FwDU/2GX7L4Lb8u7iDGY7qVJV09cdYVJUb9U5hiHrrjthR3WMhi
qpK+2d3RtbzdKb83RJ+Ye/Px0O3wBtO5WZ5o8fWoPHXMPZzo9bPuqBHtYciNrhea
ot3fWCK6TWCazSx4wU2MSoDhmu+GjxUqAwI9XhzKi5ui4YuUDZIGAZXe2XSmpyZy
KyMFSTaEMCg972rWXmBJfq6mbiEkkNWKfPCFvLmDJAQA9RR9f6euTo4BOV2/NpJ7
m0OhXwofCy/7TIontfO+j+rB0p3pVI2YEC9zSF7ITqggH47rVjkeEGEO+fDOEKJz
QqiATeDY77z5WINVFFDukbw5lMy+os848+r8WbfhWv7PMozWncIjcSxzBkTvX3QY
iG2khFbpEYXnBt/JFXnCtYVMO94KhAw8+9e0+mOZvexglEo/tIcsseK20eu8KDw0
pDPpuqvxYF47uQTts/kNVkC4Yk5ZdCnIzZCoUUbfJ/5Lo+8pRlUCd3aOgIAfwwp5
TPXdTLr3cLajVBPWUwRolvuQD7fdht0294UlKZwGhXlYJ9UwqDVfYwAoc2KVt4hI
mRMbBRdyy+LVzIOMXqYgOU0njpTZj+lTAWZkbeVmdMMUU/u0l2peGabJUbUmk35j
3UCM8MZyw4I0qI5KGlL1
=FvPw
-----END PGP SIGNATURE-----