Published: 07/07/2011 Updated: 27/05/2020

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 up to and including 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx libcurl
apple mac os x
fedoraproject fedora 14
fedoraproject fedora 15
debian debian linux 5.0
debian debian linux 6.0
debian debian linux 7.0
canonical ubuntu linux 8.04
canonical ubuntu linux 10.04
canonical ubuntu linux 10.10
canonical ubuntu linux 11.04

Debian Bug report logs - #631615 CVE-2011-2192: libcurl inappropriate GSSAPI delegation Package: curl; Maintainer for curl is Alessandro Ghedini <ghedo@debianorg>; Source for curl is src:curl (PTS, buildd, popcon) Reported by: Giuseppe Iuculano <iuculano@debianorg> Date: Sat, 25 Jun 2011 12:27:02 UTC Severity: ser ...

Multiple vulnerabilities in curl ...

Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism This is obviously a very sensitive operation, which should only be ...

CWE-255 http://curl.haxx.se/curl-gssapi-delegation.patch http://curl.haxx.se/docs/adv_20110623.html https://bugzilla.redhat.com/show_bug.cgi?id=711454 http://www.ubuntu.com/usn/USN-1158-1 http://www.redhat.com/support/errata/RHSA-2011-0918.html http://secunia.com/advisories/45088 http://secunia.com/advisories/45181 http://secunia.com/advisories/45144 http://www.debian.org/security/2011/dsa-2271 http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061992.html http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062287.html http://www.securitytracker.com/id?1025713 http://www.mandriva.com/security/advisories?name=MDVSA-2011:116 http://secunia.com/advisories/45067 http://secunia.com/advisories/45047 http://support.apple.com/kb/HT5130 http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html http://security.gentoo.org/glsa/glsa-201203-02.xml http://secunia.com/advisories/48256 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=631615 https://usn.ubuntu.com/1158-1/https://nvd.nist.gov

CVE-2011-2192

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect