Curl NTLM Buffer Overflow

high Log Correlation Engine Plugin ID 801390

Synopsis

The remote host is vulnerable to a buffer overflow.

Description

The remote host is using a version of curl (or libcurl) that is vulnerable to a remote buffer overflows. To exploit, an attacker would have to set up a rogue web server that would reply with a malicious NTLM authentication request. Upon successful exploitation, the attacker would be able to execute arbitrary commands with the rights of the web server.

Solution

Upgrade or patch according to vendor recommendations.

Plugin Details

Severity: High

ID: 801390

Family: Web Clients

Reference Information

CVE: CVE-2005-2337, CVE-2005-2628, CVE-2005-3185, CVE-2005-4077, CVE-2006-0024, CVE-2006-1439, CVE-2006-1440, CVE-2006-1441, CVE-2006-1442, CVE-2006-1443, CVE-2006-1444, CVE-2006-1445, CVE-2006-1446, CVE-2006-1447, CVE-2006-1448, CVE-2006-1449, CVE-2006-1450, CVE-2006-1451, CVE-2006-1452, CVE-2006-1453, CVE-2006-1454, CVE-2006-1455, CVE-2006-1456, CVE-2006-1457, CVE-2006-1552, CVE-2006-1614, CVE-2006-1615, CVE-2006-1630, CVE-2006-1982, CVE-2006-1983, CVE-2006-1984, CVE-2006-1985

BID: 15102, 15756, 17951

Detections

Analytics