CVE-2011-2192

Опубликовано: 07 июл. 2011

Источник: nvd

CVSS2: 4.3

EPSS Низкий

Описание

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Ссылки

http://curl.haxx.se/curl-gssapi-delegation.patch
Broken Link
http://curl.haxx.se/docs/adv_20110623.html
Vendor Advisory
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062287.html
Mailing List
Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061992.html
Mailing List
Third Party Advisory
http://secunia.com/advisories/45047
Third Party Advisory
http://secunia.com/advisories/45067
Third Party Advisory
http://secunia.com/advisories/45088
Third Party Advisory
http://secunia.com/advisories/45144
Third Party Advisory
http://secunia.com/advisories/45181
Third Party Advisory
http://secunia.com/advisories/48256
Third Party Advisory
http://security.gentoo.org/glsa/glsa-201203-02.xml
Third Party Advisory
http://support.apple.com/kb/HT5130
Third Party Advisory
http://www.debian.org/security/2011/dsa-2271
Third Party Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2011:116
Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2011-0918.html
Third Party Advisory
http://www.securitytracker.com/id?1025713
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/USN-1158-1
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=711454
Issue Tracking
Third Party Advisory
http://curl.haxx.se/curl-gssapi-delegation.patch
Broken Link

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:*

Версия от 7.10.6 (включая) до 7.21.6 (включая)

Конфигурация 2

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Версия до 10.7.3 (исключая)

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:14:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:15:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Конфигурация 5

Одно из

cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:10.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:*

EPSS

Процентиль: 86%

0.02994

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-255

Связанные уязвимости

CVE-2011-2192

ubuntu

около 15 лет назад

CVE-2011-2192

redhat

около 15 лет назад

CVE-2011-2192

debian

около 15 лет назад

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10. ...

GHSA-2jvc-33pv-cq2m

github

около 4 лет назад

ELSA-2011-0918

oracle-oval

около 15 лет назад

ELSA-2011-0918: curl security update (MODERATE)

EPSS

Процентиль: 86%

0.02994

Низкий

4.3 Medium

CVSS2

Дефекты

CWE-255