Vulnerability CVE-2015-3143: Information

Description

cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.

Severity: MEDIUM (5.0)

URL: https://nvd.nist.gov/vuln/detail/CVE-2015-3143

Published: April 24, 2015

Modified: Jan. 5, 2018

Error type identifier: CWE-264

Fixed packages

Package name	Branch	Fixed in version	Version from repository	Errata ID	Task #	State
curl	sisyphus	7.42.0-alt1	8.7.1-alt2	ALT-PU-2015-1396-1	143432	Fixed
curl	p10	7.42.0-alt1	8.7.1-alt2	ALT-PU-2015-1396-1	143432	Fixed
curl	p9	7.42.0-alt1	7.79.0-alt2	ALT-PU-2015-1396-1	143432	Fixed
curl	c10f1	7.42.0-alt1	8.6.0-alt1	ALT-PU-2015-1396-1	143432	Fixed
curl	c9f2	7.42.0-alt1	8.6.0-alt1	ALT-PU-2015-1396-1	143432	Fixed
curl	c7	7.56.1-alt1.M70C.1.1	7.56.1-alt1.M70C.1.1	ALT-PU-2018-1442-1	202075	Fixed
curl	p11	7.42.0-alt1	8.7.1-alt2	ALT-PU-2015-1396-1	143432	Fixed

References to Advisories, Solutions, and Tools

Hyperlink	Resource
DSA-3232
http://curl.haxx.se/docs/adv_20150422A.html	Vendor Advisory
USN-2591-1
FEDORA-2015-6853
FEDORA-2015-6864
MDVSA-2015:220
1032232
MDVSA-2015:219
FEDORA-2015-6728
openSUSE-SU-2015:0799
FEDORA-2015-6695
http://advisories.mageia.org/MGASA-2015-0179.html
APPLE-SA-2015-08-13-2
https://support.apple.com/kb/HT205031
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763	Vendor Advisory
HPSBHF03544	Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
GLSA-201509-02
74299
FEDORA-2015-6712
RHSA-2015:1254

Affected configurations:
1. Configuration 1
  cpe:2.3:a:haxx:curl:7.21.3:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.15.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.24.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.16.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.13.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.35.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.18.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.14.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.21.5:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.21.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.12.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.32.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.16.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.40.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.17.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.19.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.12.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.15.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.19.6:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.29.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.15.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.22.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.33.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.16.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.10.6:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.13.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.10.8:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.20.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.20.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.26.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.19.7:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.19.3:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.23.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.25.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.36.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.19.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.12.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.21.6:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.30.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.27.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.38.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.17.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.12.3:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.14.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.19.4:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.15.3:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.15.5:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.21.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.31.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.11.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.16.4:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.41.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.10.7:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.34.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.21.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.13.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.28.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.11.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.23.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.28.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.18.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.18.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.37.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.21.4:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.19.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.39.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.16.3:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.21.7:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.15.4:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.19.5:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:curl:7.11.0:*:*:*:*:*:*:*
  
  Configuration 2
  cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
  cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
  
  Configuration 3
  cpe:2.3:a:haxx:libcurl:7.19.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.19.6:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.21.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.11.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.37.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.40.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.17.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.19.4:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.30.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.25.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.12.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.21.3:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.16.4:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.12.3:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.33.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.18.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.23.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.19.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.26.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.36.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.15.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.16.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.16.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.34.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.31.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.15.5:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.35.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.22.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.20.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.21.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.14.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.28.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.11.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.18.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.13.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.21.5:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.15.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.19.3:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.17.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.24.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.13.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.10.8:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.27.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.15.3:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.19.7:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.12.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.10.6:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.41.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.23.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.21.6:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.19.5:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.14.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.21.7:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.21.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.38.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.16.3:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.13.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.15.4:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.20.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.11.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.16.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.32.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.29.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.37.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.18.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.10.7:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.28.1:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.12.2:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.39:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.15.0:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.21.4:*:*:*:*:*:*:*
  cpe:2.3:a:haxx:libcurl:7.19.2:*:*:*:*:*:*:*
  
  Configuration 4
  cpe:2.3:a:hp:system_management_homepage:*:*:*:*:*:*:*:*
  End including
  7.5.3.1
  
  Configuration 5
  cpe:2.3:o:apple:mac_os_x:10.10.0:*:*:*:*:*:*:*
  cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
  End including
  10.9.5
  cpe:2.3:o:apple:mac_os_x:10.10.4:*:*:*:*:*:*:*
  cpe:2.3:o:apple:mac_os_x:10.10.1:*:*:*:*:*:*:*
  cpe:2.3:o:apple:mac_os_x:10.10.3:*:*:*:*:*:*:*
  cpe:2.3:o:apple:mac_os_x:10.10.2:*:*:*:*:*:*:*

Version: v24.5.2

Vulnerability CVE-2015-3143: Information

Description

Fixed packages

References to Advisories, Solutions, and Tools

Configuration 1

Configuration 2

Configuration 3

Configuration 4

Configuration 5