SB2011062309 - Credentials management in curl (Alpine package)
Published: June 23, 2011
Security Bulletin ID
SB2011062309
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Credentials management (CVE-ID: CVE-2011-2192)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.
Remediation
Install update from vendor's website.