CVE-2014-0015

libcurl 7.10.6-7.34.0 - Improper Authentication via NTLM Connection Reuse

Title source: llm

Description

cURL and libcurl 7.10.6 through 7.34.0, when more than one authentication method is enabled, re-uses NTLM connections, which might allow context-dependent attackers to authenticate as other users via a request.

References (25)

Core 25

Core References

Vendor Advisory vendor-advisory x_refsource_slackware

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.502652

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/56912

Various Sources x_refsource_confirm

http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT6296

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1029710

Vendor Advisory x_refsource_confirm

http://www.vmware.com/security/advisories/VMSA-2014-0012.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127627.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2014-02/msg00066.html

Third Party Advisory vendor-advisory x_refsource_apple

http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/534161/100/0/threaded

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/65270

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2014/dsa-2849

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59458

Mailing List mailing-list x_refsource_fulldisc

http://seclists.org/fulldisclosure/2014/Dec/23

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/56728

Vendor Advisory x_refsource_confirm

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128408.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/59475

Patch, Vendor Advisory x_refsource_confirm

http://curl.haxx.se/docs/adv_20140129.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2097-1

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/56734

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/56731

Scores

EPSS 0.0127

EPSS Percentile 79.7%

Details

CWE

CWE-287

Status published

Products (50)

haxx/curl 7.10.6

haxx/curl 7.10.7

haxx/curl 7.10.8

haxx/curl 7.11.0

haxx/curl 7.11.1

haxx/curl 7.11.2

haxx/curl 7.12.0

haxx/curl 7.12.1

haxx/curl 7.12.2

haxx/curl 7.12.3

... and 40 more

Published Feb 02, 2014

Tracked Since Feb 18, 2026