CVE-2014-0015

cURL/libcurl <7.35 - Auth Bypass

Title source: llm

Description

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.

References (25)

[Vendor Advisory] http://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.502652

[Vendor Advisory] http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743

[Third Party Advisory] http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html

[Patch, Vendor Advisory] http://curl.haxx.se/docs/adv_20140129.html

[Mailing List] http://lists.opensuse.org/opensuse-updates/2014-02/msg00066.html

[Mailing List] http://seclists.org/fulldisclosure/2014/Dec/23

[Vendor Advisory] http://secunia.com/advisories/56728

[Third Party Advisory] http://secunia.com/advisories/56731

[Vendor Advisory] http://secunia.com/advisories/56734

[Third Party Advisory] http://secunia.com/advisories/56912

[Third Party Advisory] http://secunia.com/advisories/59458

[Third Party Advisory] http://secunia.com/advisories/59475

[Vendor Advisory] http://support.apple.com/kb/HT6296

[Various Sources] http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862

[Vendor Advisory] http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

[Vendor Advisory] http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

[Vendor Advisory] http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1029710

[Vendor Advisory] http://www.ubuntu.com/usn/USN-2097-1

[Vendor Advisory] http://www.vmware.com/security/advisories/VMSA-2014-0012.html

... and 5 more

Scores

EPSS 0.0188

EPSS Percentile 83.0%

Classification

CWE

CWE-287

Status draft

Affected Products (50)

haxx/libcurl

... and 35 more

Timeline

Published Feb 02, 2014

Tracked Since Feb 18, 2026