|
|
Family: Mandrake Local Security Checks --> Category: infos
MDKSA-2005:224: curl Vulnerability Scan
Vulnerability Scan Summary
Check for the version of the curl package
Detailed Explanation for this Vulnerability Test
The remote host is missing the patch for the advisory MDKSA-2005:224 (curl).
Stefan Esser discovered that libcurl's URL parser function can have a malloced
buffer overflows in two ways if given a too long URL. It cannot be triggered by
a redirect, which makes remote exploitation unlikely, but can be passed
directly to libcurl (allowing for local exploitation) and could also be used to
break out of PHP's safe_mode/ open_basedir. This vulnerability only exists in
libcurl and curl 7.11.2 up to and including 7.15.0, which means that Corporate
Server 2.1 and Corporate 3.0 are not vulnerable. The updated packages have been
patched to correct the problem. As well, updated php-curl packages are
available that provide a new curl PHP module compiled against the fixed code.
Solution : http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:224
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|
