Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
5
CVSSv2

CVE-2015-3143

Published: 24/04/2015 Updated: 05/01/2018
CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10
VMScore: 445
Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N
Subscribe to Haxx

Vulnerability Summary

cURL and libcurl 7.10.6 up to and including 7.41.0 does not properly re-use NTLM connections, which allows remote malicious users to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.

Vulnerable Product Search on Vulmon Subscribe to Product

haxx curl 7.41.0

haxx curl 7.40.0

haxx curl 7.39.0

haxx curl 7.32.0

haxx curl 7.31.0

haxx curl 7.24.0

haxx curl 7.25.0

haxx curl 7.21.3

haxx curl 7.21.2

haxx curl 7.19.4

haxx curl 7.19.3

haxx curl 7.18.0

haxx curl 7.17.1

haxx curl 7.15.3

haxx curl 7.15.4

haxx curl 7.13.0

haxx curl 7.12.3

haxx curl 7.12.2

haxx curl 7.11.2

haxx curl 7.38.0

haxx curl 7.37.1

haxx curl 7.30.0

haxx curl 7.29.0

haxx curl 7.23.1

haxx curl 7.23.0

haxx curl 7.20.0

haxx curl 7.20.1

haxx curl 7.19.6

haxx curl 7.19.2

haxx curl 7.17.0

haxx curl 7.16.4

haxx curl 7.14.0

haxx curl 7.14.1

haxx curl 7.13.1

haxx curl 7.10.6

haxx curl 7.11.0

haxx curl 7.10.7

haxx curl 7.36.0

haxx curl 7.35.0

haxx curl 7.28.1

haxx curl 7.28.0

haxx curl 7.22.0

haxx curl 7.21.7

haxx curl 7.21.1

haxx curl 7.21.0

haxx curl 7.19.1

haxx curl 7.19.0

haxx curl 7.16.3

haxx curl 7.16.2

haxx curl 7.16.1

haxx curl 7.15.0

haxx curl 7.15.1

haxx curl 7.10.8

haxx curl 7.11.1

haxx curl 7.34.0

haxx curl 7.33.0

haxx curl 7.27.0

haxx curl 7.26.0

haxx curl 7.21.6

haxx curl 7.21.5

haxx curl 7.21.4

haxx curl 7.19.7

haxx curl 7.19.5

haxx curl 7.18.2

haxx curl 7.18.1

haxx curl 7.16.0

haxx curl 7.15.5

haxx curl 7.15.2

haxx curl 7.13.2

haxx curl 7.12.0

haxx curl 7.12.1

canonical ubuntu linux 15.04

debian debian linux 7.0

canonical ubuntu linux 12.04

canonical ubuntu linux 14.04

canonical ubuntu linux 14.10

haxx libcurl 7.12.0

haxx libcurl 7.12.1

haxx libcurl 7.14.1

haxx libcurl 7.15.0

haxx libcurl 7.16.2

haxx libcurl 7.16.3

haxx libcurl 7.19.0

haxx libcurl 7.19.1

haxx libcurl 7.20.0

haxx libcurl 7.20.1

haxx libcurl 7.21.0

haxx libcurl 7.21.7

haxx libcurl 7.22.0

haxx libcurl 7.28.0

haxx libcurl 7.28.1

haxx libcurl 7.35.0

haxx libcurl 7.37.0

haxx libcurl 7.10.6

haxx libcurl 7.10.7

haxx libcurl 7.12.2

haxx libcurl 7.12.3

haxx libcurl 7.15.1

haxx libcurl 7.15.2

haxx libcurl 7.15.3

haxx libcurl 7.16.4

haxx libcurl 7.17.0

haxx libcurl 7.19.2

haxx libcurl 7.19.3

haxx libcurl 7.21.1

haxx libcurl 7.21.2

haxx libcurl 7.23.0

haxx libcurl 7.23.1

haxx libcurl 7.29.0

haxx libcurl 7.30.0

haxx libcurl 7.37.1

haxx libcurl 7.38.0

haxx libcurl 7.10.8

haxx libcurl 7.11.0

haxx libcurl 7.13.0

haxx libcurl 7.13.1

haxx libcurl 7.15.4

haxx libcurl 7.15.5

haxx libcurl 7.17.1

haxx libcurl 7.18.0

haxx libcurl 7.19.4

haxx libcurl 7.19.5

haxx libcurl 7.21.3

haxx libcurl 7.21.4

haxx libcurl 7.24.0

haxx libcurl 7.25.0

haxx libcurl 7.32.0

haxx libcurl 7.31.0

haxx libcurl 7.39

haxx libcurl 7.40.0

haxx libcurl 7.11.1

haxx libcurl 7.11.2

haxx libcurl 7.13.2

haxx libcurl 7.14.0

haxx libcurl 7.16.0

haxx libcurl 7.16.1

haxx libcurl 7.18.1

haxx libcurl 7.18.2

haxx libcurl 7.19.6

haxx libcurl 7.19.7

haxx libcurl 7.21.5

haxx libcurl 7.21.6

haxx libcurl 7.26.0

haxx libcurl 7.27.0

haxx libcurl 7.34.0

haxx libcurl 7.36.0

haxx libcurl 7.33.0

haxx libcurl 7.41.0

hp system management homepage

apple mac os x

apple mac os x 10.10.4

apple mac os x 10.10.3

apple mac os x 10.10.2

apple mac os x 10.10.1

apple mac os x 10.10.0

Vendor Advisories

Red Hat: Moderate: curl security, bug fix, and enhancement update
Synopsis Moderate: curl security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic Updated curl packages that fix multiple security issues, several bugs, andadd two enhancements are now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as ...
Ubuntu Security Notice: curl vulnerabilities
Several security issues were fixed in curl ...
Debian Security Advisories: DSA-3232-1 curl -- security update
Several vulnerabilities were discovered in cURL, an URL transfer library: CVE-2015-3143 NTLM-authenticated connections could be wrongly reused for requests without any credentials set, leading to HTTP requests being sent over the connection authenticated as a different user This is similar to the issue fixed in DSA-2849-1 CVE-201 ...
Amazon Linux AMI: ALAS-2015-514
It was discovered that libcurl could incorrectly reuse NTLM-authenticated connections for subsequent unauthenticated requests to the same host If an application using libcurl established an NTLM-authenticated connection to a server, and sent subsequent unauthenticed requests to the same server, the unauthenticated requests could be sent over the N ...
Red Hat: CVE-2015-3143
It was discovered that libcurl could incorrectly reuse NTLM-authenticated connections for subsequent unauthenticated requests to the same host If an application using libcurl established an NTLM-authenticated connection to a server, and sent subsequent unauthenticated requests to the same server, the unauthenticated requests could be sent over the ...

References

CWE-264http://www.debian.org/security/2015/dsa-3232http://curl.haxx.se/docs/adv_20150422A.htmlhttp://www.ubuntu.com/usn/USN-2591-1http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.htmlhttp://www.mandriva.com/security/advisories?name=MDVSA-2015:220http://www.securitytracker.com/id/1032232http://www.mandriva.com/security/advisories?name=MDVSA-2015:219http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.htmlhttp://lists.opensuse.org/opensuse-updates/2015-04/msg00057.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.htmlhttp://advisories.mageia.org/MGASA-2015-0179.htmlhttp://lists.apple.com/archives/security-announce/2015/Aug/msg00001.htmlhttps://support.apple.com/kb/HT205031https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763http://marc.info/?l=bugtraq&m=145612005512270&w=2http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlhttp://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlhttp://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743https://security.gentoo.org/glsa/201509-02http://www.securityfocus.com/bid/74299http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1254.htmlhttps://access.redhat.com/errata/RHSA-2015:2159https://usn.ubuntu.com/2591-1/https://nvd.nist.govhttps://access.redhat.com/security/cve/cve-2015-3143
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322administrator privilegesCVE-2024-1579hardcodedCVE-2023-20198CVE-2024-33587CVE-2024-33449CVE-2024-4308HTML injection
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook