|
Family: Ubuntu Local Security Checks --> Category: infos
USN205-1 : curl, wget vulnerabilities Vulnerability Scan
Vulnerability Scan Summary curl, wget vulnerabilities
Detailed Explanation for this Vulnerability Test
Synopsis :
These remote packages are missing security patches :
- curl
- libcurl2
- libcurl2-dbg
- libcurl2-dev
- libcurl2-gssapi
- libcurl3
- libcurl3-dbg
- libcurl3-dev
- libcurl3-gssapi
- wget
Description :
A buffer overflow has been found in the NTLM authentication handler of
the Curl library and wget. By tricking an user or automatic system
that uses the Curl library, the curl application, or wget into
visiting a specially-crafted web site, a remote attacker could exploit
this to execute arbitrary code with the rights of the calling
user.
The Ubuntu 4.10 and 5.04 versions of wget are not affected by this.
Solution :
Upgrade to :
- curl-7.14.0-2ubuntu1.1 (Ubuntu 5.10)
- libcurl2-7.11.2-12ubuntu3.2 (Ubuntu 5.04)
- libcurl2-dbg-7.12.0.is.7.11.2-1ubuntu0.2 (Ubuntu 4.10)
- libcurl2-dev-7.11.2-12ubuntu3.2 (Ubuntu 5.04)
- libcurl2-gssapi-7.12.0.is.7.11.2-1ubuntu0.2 (Ubuntu 4.10)
- libcurl3-7.14.0-2ubuntu1.1 (Ubuntu 5.10)
- libcurl3-dbg-7.14.0-2ubuntu1.1 (Ubuntu 5.10)
- libcurl3-dev-7.14.0-2ubuntu1.1 (Ubuntu 5.10)
- libcurl3-gssapi-7.14.0-2ubuntu1.1 (Ubuntu 5.10)
- wget-1.10-2ubuntu0.1 (Ubuntu 5.10)
Threat Level: High
Click HERE for more information and discussions on this network vulnerability scan.
|