libcURL、ならびに 7.12.1 および他のバージョンの cURL にある複数のスタックベースのバッファオーバーフローにより、リモートの悪意ある　Web サーバーが、デコード時に意図されたバッファの長さを超えるbase64 エンコードの返信を介して、任意のコードを実行する可能性があります。これは、(1) NTLM 認証中の http_ntlm.c の Curl_input_ntlm 関数または (2) Kerberos 認証中の krb4.c の Curl_krb_kauth 関数と krb4_auth 関数により、適切に処理されません。

在 libcURL 和 cURL 7.12.1，以及可能還有其他版本中，多個堆疊型緩衝區溢位允許遠端惡意 Web 伺服器透過在解碼時會超過預定緩衝區長度的 base64 編碼回覆來執行任意程式碼，因為此情況 (1) 在 NTLM 驗證期間，無法由 http_ntlm.c 中的 Curl_input_ntlm 函式正確處理，或 (2) 在 Kerberos 驗證期間，無法由 krb4.c 中的 Curl_krb_kauth 和 krb4_auth 函式正確處理。

libcURL 和 cURL 7.12.1 以及可能其他版本中存在多种基于堆栈的缓冲区溢出，可允许远程恶意 Web 服务器通过 base64 编码的回复执行任意代码，该回复在解码时超过预期缓冲区长度，(1) 在 NTLM 认证期间 http_ntlm.c 中的 Curl_input_ntlm 函数或者 (2) 在 Kerberos 认证期间 krb4.c 中的Curl_krb_kauth 和 krb4_auth 函数都无法正确处理它。

The remote host is missing the patch for the advisory SUSE-SA:2005:011 (curl).


infamous41md@hotpop.com reported a vulnerability in libcurl, the HTTP/FTP retrieval library. This library is used by lots of programs, including YaST2 and PHP4.

The NTLM authorization in curl had a buffer overflow in the base64 decoding which allows a remote attacker using a prepared remote server to execute code for the user using curl.

The Kerberos authorization has a similar bug, but is not compiled in on SUSE Linux.

This is tracked by the Mitre CVE ID CVE-2005-0490.

The remote host is affected by the vulnerability described in GLSA-200503-20 (curl: NTLM response buffer overflow)

    curl fails to properly check boundaries when handling NTLM     authentication.
  Impact :

    With a malicious server an attacker could send a carefully crafted     NTLM response to a connecting client leading to the execution of     arbitrary code with the permissions of the user running curl.
  Workaround :

    Disable NTLM authentication by not using the --anyauth or --ntlm     options.

Two iDEFENSE Security Advisories reports :

An exploitable stack-based buffer overflow condition exists when using NT Lan Manager (NTLM) authentication. The problem specifically exists within Curl_input_ntlm() defined in lib/http_ntlm.c.

Successful exploitation allows remote attackers to execute arbitrary code under the privileges of the target user. Exploitation requires that an attacker either coerce or force a target to connect to a malicious server using NTLM authentication.

An exploitable stack-based buffer overflow condition exists when using Kerberos authentication. The problem specifically exists within the functions Curl_krb_kauth() and krb4_auth() defined in lib/krb4.c.

Successful exploitation allows remote attackers to execute arbitrary code under the privileges of the target user. Exploitation requires that an attacker either coerce or force a target to connect to a malicious server using Kerberos authentication.

'infamous41md' discovered a buffer overflow vulnerability in libcurl's NTLM authorization base64 decoding. This could allow a remote attacker using a prepared remote server to execute arbitrary code as the user running curl.

The updated packages are patched to deal with these issues.

Updated curl packages are now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

cURL is a tool for getting files from FTP, HTTP, Gopher, Telnet, and Dict servers, using any of the supported protocols. cURL is designed to work without user interaction or any kind of interactivity.

Multiple buffer overflow bugs were found in the way curl processes base64 encoded replies. If a victim can be tricked into visiting a URL with curl, a malicious web server could execute arbitrary code on a victim's machine. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0490 to this issue.

All users of curl are advised to upgrade to these updated packages, which contain backported fixes for these issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:340 advisory.

  - security flaw (CVE-2005-0490)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

infamous41md discovered a buffer overflow in cURL's NT LAN Manager (NTLM) authentication handling. By sending a specially crafted long NTLM reply packet, a remote attacker could overflow the reply buffer.
This could lead to execution of arbitrary attacker specified code with the privileges of the application using the cURL library.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.

The remote host is using a version of curl (or libcurl) that is vulnerable to several remote buffer overflows. To exploit this vulnerability, an attacker would have to set up a rogue web server that would reply with a malicious NTLM or Kerberos authentication request.  Upon successful exploitation, the attacker would be able to execute arbitrary commands with the rights of the web server. 

ID	名稱	產品	系列	已發布	已更新	嚴重性
78203	F5 Networks BIG-IP：cURL のバッファオーバーフローの脆弱性（SOL4447）	Nessus	F5 Networks Local Security Checks	2014/10/10	2021/1/11	medium
78203	F5 Networks BIG-IP：cURL 緩衝區溢位弱點 (SOL4447)	Nessus	F5 Networks Local Security Checks	2014/10/10	2021/1/11	medium
78203	F5 Networks BIG-IP：cURL 缓冲区溢出漏洞 (SOL4447)	Nessus	F5 Networks Local Security Checks	2014/10/10	2021/1/11	medium
17238	SUSE-SA:2005:011: curl	Nessus	SuSE Local Security Checks	2005/3/1	2021/1/14	medium
17345	GLSA-200503-20 : curl: NTLM response buffer overflow	Nessus	Gentoo Local Security Checks	2005/3/17	2021/1/6	medium
19038	FreeBSD : curl -- authentication buffer overflow vulnerability (96df5fd0-8900-11d9-aa18-0001020eed82)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	medium
17277	Mandrake Linux Security Advisory : curl (MDKSA-2005:048)	Nessus	Mandriva Local Security Checks	2005/3/6	2021/1/6	medium
21805	CentOS 3 / 4 : curl (CESA-2005:340)	Nessus	CentOS Local Security Checks	2006/7/3	2021/1/4	medium
17979	RHEL 4 : curl (RHSA-2005:340)	Nessus	Red Hat Local Security Checks	2005/4/6	2024/4/27	high
20711	Ubuntu 4.10 : curl vulnerability (USN-86-1)	Nessus	Ubuntu Local Security Checks	2006/1/15	2021/1/19	medium
78203	F5 Networks BIG-IP : cURL buffer overflow vulnerability (SOL4447)	Nessus	F5 Networks Local Security Checks	2014/10/10	2021/1/11	medium
2640	Curl < 7.13.1 NTLM Stack-based Buffer Overflow	Nessus Network Monitor	Web Clients	2005/2/22	2019/3/6	high
801387	Curl < 7.13.1 NTLM Stack-based Buffer Overflow	Log Correlation Engine	Web Clients			high

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

high

high