Published: 24/04/2015 Updated: 30/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The sanitize_cookie_path function in cURL and libcurl 7.31.0 up to and including 7.41.0 does not properly calculate an index, which allows remote malicious users to cause a denial of service (out-of-bounds write and crash) or possibly have other unspecified impact via a cookie path containing only a double-quote character.

Vulnerable Product	Search on Vulmon	Subscribe to Product
fedoraproject fedora 21
fedoraproject fedora 22
canonical ubuntu linux 12.04
debian debian linux 7.0
canonical ubuntu linux 15.04
canonical ubuntu linux 14.10
canonical ubuntu linux 14.04
haxx curl 7.37.1
haxx curl 7.38.0
haxx curl 7.33.0
haxx curl 7.34.0
haxx curl 7.35.0
haxx curl 7.41.0
haxx curl 7.36.0
haxx curl 7.37.0
haxx curl 7.31.0
haxx curl 7.32.0
haxx curl 7.39.0
haxx curl 7.40.0
apple mac os x 10.10.2
apple mac os x 10.10.3
apple mac os x 10.10.0
apple mac os x 10.10.1
apple mac os x 10.10.4
oracle solaris 11.3
haxx libcurl 7.32.0
haxx libcurl 7.33.0
haxx libcurl 7.40.0
haxx libcurl 7.41.0
haxx libcurl 7.37.0
haxx libcurl 7.37.1
haxx libcurl 7.30.0
haxx libcurl 7.31.0
haxx libcurl 7.38.0
haxx libcurl 7.39
haxx libcurl 7.34.0
haxx libcurl 7.35.0
haxx libcurl 7.36.0
hp system management homepage
opensuse opensuse 13.1
opensuse opensuse 13.2

Several security issues were fixed in curl ...

Several vulnerabilities were discovered in cURL, an URL transfer library: CVE-2015-3143 NTLM-authenticated connections could be wrongly reused for requests without any credentials set, leading to HTTP requests being sent over the connection authenticated as a different user This is similar to the issue fixed in DSA-2849-1 CVE-201 ...

It was discovered that libcurl could incorrectly reuse NTLM-authenticated connections for subsequent unauthenticated requests to the same host If an application using libcurl established an NTLM-authenticated connection to a server, and sent subsequent unauthenticed requests to the same server, the unauthenticated requests could be sent over the N ...

It was discovered that libcurl did not properly process cookies with a specially crafted "path" element If an application using libcurl connected to a malicious HTTP server sending specially crafted "Set-Cookies" headers, this could lead to an out-of-bounds read, and possibly cause that application to crash ...

Демонстрация бага CVE-2015-3145 описание бага Основное описание описано здесь: CVE-2015-3145 Для демонстрации используется sanitize_cookie_path() из версии libcurl — 7340, можно скачать архивом отсюда Функция некорректно обрабат�

CWE-119 http://www.debian.org/security/2015/dsa-3232 http://curl.haxx.se/docs/adv_20150422C.html http://www.ubuntu.com/usn/USN-2591-1 http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html http://www.securitytracker.com/id/1032232 http://www.mandriva.com/security/advisories?name=MDVSA-2015:219 http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html http://advisories.mageia.org/MGASA-2015-0179.html http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html https://support.apple.com/kb/HT205031 https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763 http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html http://www.securityfocus.com/bid/74303 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743 https://security.gentoo.org/glsa/201509-02 http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html https://usn.ubuntu.com/2591-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2015-3145

CVE-2015-3145

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect