Login
Login-Name Passwort


 
Newsletter
Werbung

Sicherheit: Mehrere Probleme in curl
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in curl
ID: MDVSA-2015:098
Distribution: Mandriva
Plattformen: Mandriva Business Server 2.0
Datum: Sa, 28. März 2015, 14:14
Referenzen: http://advisories.mageia.org/MGASA-2014-0153.html
http://advisories.mageia.org/MGASA-2014-0385.html
http://advisories.mageia.org/MGASA-2014-0444.html
http://advisories.mageia.org/MGASA-2015-0020.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0015
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3613
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3620
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8150

Originalnachricht

This is a multi-part message in MIME format...

------------=_1427541150-3111-20

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2015:098
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : curl
Date : March 28, 2015
Affected: Business Server 2.0
_______________________________________________________________________

Problem Description:

Updated curl packages fix security vulnerabilities:

Paras Sethia discovered that libcurl would sometimes mix up multiple
HTTP and HTTPS connections with NTLM authentication to the same server,
sending requests for one user over the connection authenticated as
a different user (CVE-2014-0015).

libcurl can in some circumstances re-use the wrong connection when
asked to do transfers using other protocols than HTTP and FTP, causing
a transfer that was initiated by an application to wrongfully re-use
an existing connection to the same server that was authenticated
using different credentials (CVE-2014-0138).

libcurl incorrectly validates wildcard SSL certificates containing
literal IP addresses, so under certain conditions, it would allow
and use a wildcard match specified in the CN field, allowing a
malicious server to participate in a MITM attack or just fool users
into believing that it is a legitimate site (CVE-2014-0139).

In cURL before 7.38.0, libcurl can be fooled to both sending cookies
to wrong sites and into allowing arbitrary sites to set cookies for
others. For this problem to trigger, the client application must use
the numerical IP address in the URL to access the site (CVE-2014-3613).

In cURL before 7.38.0, libcurl wrongly allows cookies to be set for Top
Level Domains (TLDs), thus making them apply broader than cookies are
allowed. This can allow arbitrary sites to set cookies that then would
get sent to a different and unrelated site or domain (CVE-2014-3620).

Symeon Paraschoudis discovered that the curl_easy_duphandle() function
in cURL has a bug that can lead to libcurl eventually sending off
sensitive data that was not intended for sending, while performing
a HTTP POST operation. This bug requires CURLOPT_COPYPOSTFIELDS and
curl_easy_duphandle() to be used in that order, and then the duplicate
handle must be used to perform the HTTP POST. The curl command line
tool is not affected by this problem as it does not use this sequence
(CVE-2014-3707).

When libcurl sends a request to a server via a HTTP proxy, it copies
the entire URL into the request and sends if off. If the given URL
contains line feeds and carriage returns those will be sent along to
the proxy too, which allows the program to for example send a separate
HTTP request injected embedded in the URL (CVE-2014-8150).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0015
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3613
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3620
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3707
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8150
http://advisories.mageia.org/MGASA-2014-0153.html
http://advisories.mageia.org/MGASA-2014-0385.html
http://advisories.mageia.org/MGASA-2014-0444.html
http://advisories.mageia.org/MGASA-2015-0020.html
_______________________________________________________________________

Updated Packages:

Mandriva Business Server 2/X86_64:
498d59be3a6a4ace215c0d98fb4abede mbs2/x86_64/curl-7.34.0-3.1.mbs2.x86_64.rpm
75a821b73a75ca34f1747a0f7479267f
mbs2/x86_64/curl-examples-7.34.0-3.1.mbs2.noarch.rpm
f5d3aad5f0fd9db68b87c648aaabbb4a
mbs2/x86_64/lib64curl4-7.34.0-3.1.mbs2.x86_64.rpm
4f356a2c97f9f64124b4e8ebe307826a
mbs2/x86_64/lib64curl-devel-7.34.0-3.1.mbs2.x86_64.rpm
d010a357d76a8eb967c7c52f92fb35ae mbs2/SRPMS/curl-7.34.0-3.1.mbs2.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVFn3GmqjQ0CJFipgRAu1CAJ9iEOw8vZuH/tA8vyx1xmbC4vySTgCgqExY
Fpa5OZRsP4i0DWRwsyxOCt4=
=5PNM
-----END PGP SIGNATURE-----


------------=_1427541150-3111-20
Content-Type: text/plain; charset="UTF-8";
name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________


------------=_1427541150-3111-20--
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung