Published: 29/01/2016 Updated: 17/10/2018

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.3 | Impact Score: 3.4 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N

The ConnectionExists function in lib/url.c in libcurl prior to 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote malicious users to authenticate as other users via a request, a similar issue to CVE-2014-0015.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx curl
canonical ubuntu linux 15.10
canonical ubuntu linux 15.04
canonical ubuntu linux 14.04
canonical ubuntu linux 12.04
debian debian linux 7.0

curl would incorrectly re-use credentials ...

Isaac Boukris discovered that cURL, an URL transfer library, reused NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for the new transfer This could lead to HTTP requests being sent over the connection authenticated as a different user For the stable distribut ...

The ConnectionExists function in lib/urlc in libcurl before 7470 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015 (CVE-2016-0755) ...

The ConnectionExists function in lib/urlc in libcurl before 7470 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015 ...

CWE-287 http://www.ubuntu.com/usn/USN-2882-1 http://www.debian.org/security/2016/dsa-3455 http://curl.haxx.se/docs/adv_20160127A.html https://support.apple.com/HT207170 http://lists.apple.com/archives/security-announce/2016/Sep/msg00006.html http://www.securityfocus.com/bid/82307 http://lists.opensuse.org/opensuse-updates/2016-02/msg00031.html http://www.slackware.com/security/viewer.php?l=slackware-security&y=2016&m=slackware-security.519965 http://lists.opensuse.org/opensuse-updates/2016-02/msg00047.html http://packetstormsecurity.com/files/135695/Slackware-Security-Advisory-curl-Updates.html http://lists.opensuse.org/opensuse-updates/2016-02/msg00044.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177342.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177383.html http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176546.html http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176413.html http://www.securitytracker.com/id/1034882 https://security.gentoo.org/glsa/201701-47 http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html https://usn.ubuntu.com/2882-1/https://nvd.nist.gov

CVE-2016-0755

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect