Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2011-2192

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Published

2011-07-07T21:55:02.320

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 4.3 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-255

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	haxx	libcurl	≤ 7.21.6	Yes
Operating System	apple	mac_os_x	< 10.7.3	Yes
Operating System	fedoraproject	fedora	14	Yes
Operating System	fedoraproject	fedora	15	Yes
Operating System	debian	debian_linux	5.0	Yes
Operating System	debian	debian_linux	6.0	Yes
Operating System	debian	debian_linux	7.0	Yes
Operating System	canonical	ubuntu_linux	8.04	Yes
Operating System	canonical	ubuntu_linux	10.04	Yes
Operating System	canonical	ubuntu_linux	10.10	Yes
Operating System	canonical	ubuntu_linux	11.04	Yes

References

http://curl.haxx.se/curl-gssapi-delegation.patch Broken Link ([email protected])
http://curl.haxx.se/docs/adv_20110623.html Vendor Advisory ([email protected])
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html Mailing List, Third Party Advisory ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062287.html Mailing List, Third Party Advisory ([email protected])
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061992.html Mailing List, Third Party Advisory ([email protected])
http://secunia.com/advisories/45047 Third Party Advisory ([email protected])
http://secunia.com/advisories/45067 Third Party Advisory ([email protected])
http://secunia.com/advisories/45088 Third Party Advisory ([email protected])
http://secunia.com/advisories/45144 Third Party Advisory ([email protected])
http://secunia.com/advisories/45181 Third Party Advisory ([email protected])
http://secunia.com/advisories/48256 Third Party Advisory ([email protected])
http://security.gentoo.org/glsa/glsa-201203-02.xml Third Party Advisory ([email protected])
http://support.apple.com/kb/HT5130 Third Party Advisory ([email protected])
http://www.debian.org/security/2011/dsa-2271 Third Party Advisory ([email protected])
http://www.mandriva.com/security/advisories?name=MDVSA-2011:116 Third Party Advisory ([email protected])
http://www.redhat.com/support/errata/RHSA-2011-0918.html Third Party Advisory ([email protected])
http://www.securitytracker.com/id?1025713 Third Party Advisory, VDB Entry ([email protected])
http://www.ubuntu.com/usn/USN-1158-1 Third Party Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=711454 Issue Tracking, Third Party Advisory ([email protected])
http://curl.haxx.se/curl-gssapi-delegation.patch Broken Link (af854a3a-2127-422b-91ae-364da2661108)
http://curl.haxx.se/docs/adv_20110623.html Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2011-July/062287.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061992.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/45047 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/45067 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/45088 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/45144 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/45181 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://secunia.com/advisories/48256 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://security.gentoo.org/glsa/glsa-201203-02.xml Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://support.apple.com/kb/HT5130 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.debian.org/security/2011/dsa-2271 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.mandriva.com/security/advisories?name=MDVSA-2011:116 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.redhat.com/support/errata/RHSA-2011-0918.html Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
http://www.securitytracker.com/id?1025713 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
http://www.ubuntu.com/usn/USN-1158-1 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=711454 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)