Published: 15/04/2014 Updated: 09/10/2018

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

The default configuration in cURL and libcurl 7.10.6 prior to 7.36.0 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent malicious users to connect as other users via a request, a similar issue to CVE-2014-0015.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx curl 7.10.6
haxx curl 7.12.2
haxx curl 7.12.3
haxx curl 7.15.1
haxx curl 7.15.2
haxx curl 7.16.3
haxx curl 7.16.4
haxx curl 7.19.2
haxx curl 7.19.3
haxx curl 7.21.0
haxx curl 7.21.1
haxx curl 7.22.0
haxx curl 7.23.0
haxx curl 7.23.1
haxx curl 7.29.0
haxx curl 7.30.0
haxx libcurl 7.10.8
haxx libcurl 7.11.0
haxx libcurl 7.13.1
haxx libcurl 7.13.2
haxx libcurl 7.15.4
haxx libcurl 7.15.5
haxx libcurl 7.17.1
haxx libcurl 7.18.0
haxx curl 7.10.7
haxx curl 7.10.8
haxx curl 7.13.0
haxx curl 7.13.1
haxx curl 7.15.3
haxx curl 7.15.4
haxx curl 7.17.0
haxx curl 7.17.1
haxx curl 7.18.0
haxx curl 7.19.4
haxx curl 7.19.5
haxx curl 7.21.2
haxx curl 7.21.3
haxx curl 7.24.0
haxx curl 7.25.0
haxx curl 7.31.0
haxx curl 7.32.0
haxx libcurl 7.11.1
haxx libcurl 7.11.2
haxx libcurl 7.14.0
haxx libcurl 7.14.1
haxx libcurl 7.16.0
haxx libcurl 7.16.1
haxx libcurl 7.18.1
haxx libcurl 7.18.2
haxx libcurl 7.19.7
haxx libcurl 7.20.0
haxx libcurl 7.21.5
haxx libcurl 7.21.6
haxx libcurl 7.26.0
haxx libcurl 7.27.0
haxx libcurl 7.34.0
haxx curl 7.35.0
haxx curl 7.12.0
haxx curl 7.12.1
haxx curl 7.14.1
haxx curl 7.15.0
haxx curl 7.16.1
haxx curl 7.16.2
haxx curl 7.19.0
haxx curl 7.19.1
haxx curl 7.20.0
haxx curl 7.20.1
haxx curl 7.21.6
haxx curl 7.21.7
haxx curl 7.28.0
haxx curl 7.28.1
haxx libcurl 7.10.6
haxx libcurl 7.10.7
haxx libcurl 7.12.2
haxx libcurl 7.12.3
haxx libcurl 7.13.0
haxx libcurl 7.15.2
haxx libcurl 7.15.3
haxx libcurl 7.16.4
haxx libcurl 7.17.0
haxx libcurl 7.19.3
haxx libcurl 7.19.4
haxx libcurl 7.21.1
haxx libcurl 7.21.2
haxx libcurl 7.23.0
haxx libcurl 7.23.1
haxx libcurl 7.30.0
haxx libcurl 7.31.0
haxx libcurl 7.19.5
haxx libcurl 7.19.6
haxx libcurl 7.21.3
haxx libcurl 7.21.4
haxx libcurl 7.24.0
haxx libcurl 7.25.0
haxx libcurl 7.32.0
haxx libcurl 7.33.0
haxx curl 7.11.0
haxx curl 7.11.1
haxx curl 7.11.2
haxx curl 7.13.2
haxx curl 7.14.0
haxx curl 7.15.5
haxx curl 7.16.0
haxx curl 7.18.1
haxx curl 7.18.2
haxx curl 7.19.6
haxx curl 7.19.7
haxx curl 7.21.4
haxx curl 7.21.5
haxx curl 7.26.0
haxx curl 7.27.0
haxx curl 7.33.0
haxx curl 7.34.0
haxx libcurl 7.12.0
haxx libcurl 7.12.1
haxx libcurl 7.15.0
haxx libcurl 7.15.1
haxx libcurl 7.16.2
haxx libcurl 7.16.3
haxx libcurl 7.19.0
haxx libcurl 7.19.1
haxx libcurl 7.19.2
haxx libcurl 7.20.1
haxx libcurl 7.21.0
haxx libcurl 7.21.7
haxx libcurl 7.22.0
haxx libcurl 7.28.0
haxx libcurl 7.28.1
haxx libcurl 7.29.0
haxx libcurl 7.35.0
debian debian linux 7.0

Debian Bug report logs - #742728 curl: CVE-2014-0138 CVE-2014-0139 Package: curl; Maintainer for curl is Alessandro Ghedini <ghedo@debianorg>; Source for curl is src:curl (PTS, buildd, popcon) Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 26 Mar 2014 17:51:12 UTC Severity: grave Tags: fixed-upstr ...

Several security issues were fixed in curl ...

Two vulnerabilities have been discovered in cURL, an URL transfer library The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2014-0138 Steve Holme discovered that libcurl can in some circumstances re-use the wrong connection when asked to do transfers using other protocols than HTTP and FTP CVE-20 ...

The default configuration in cURL and libcurl 7106 before 7360 re-uses (1) SCP, (2) SFTP, (3) POP3, (4) POP3S, (5) IMAP, (6) IMAPS, (7) SMTP, (8) SMTPS, (9) LDAP, and (10) LDAPS connections, which might allow context-dependent attackers to connect as other users via a request, a similar issue to CVE-2014-0015 ...

Critical Infrastructure Sectors: Energy

CWE-287 http://www.debian.org/security/2014/dsa-2902 http://curl.haxx.se/docs/adv_20140326A.html http://www.getchef.com/blog/2014/04/09/chef-server-11-0-12-release/http://secunia.com/advisories/57836 http://secunia.com/advisories/57966 http://www.getchef.com/blog/2014/04/09/enterprise-chef-1-4-9-release/http://www.getchef.com/blog/2014/04/09/enterprise-chef-11-1-3-release/http://secunia.com/advisories/57968 http://secunia.com/advisories/59458 http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095862 http://www.vmware.com/security/advisories/VMSA-2014-0012.html http://seclists.org/fulldisclosure/2014/Dec/23 http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html http://www-01.ibm.com/support/docview.wss?uid=swg21675820 http://secunia.com/advisories/58615 http://www.ubuntu.com/usn/USN-2167-1 http://lists.opensuse.org/opensuse-updates/2014-04/msg00042.html http://www.securityfocus.com/archive/1/534161/100/0/threaded https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742728 https://usn.ubuntu.com/2167-1/https://nvd.nist.gov https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-03

Get Started

CVE-2014-0138

Vulnerability Summary

Vendor Advisories

ICS Advisories

References

Vulmon Search

About

Products

Connect