Test Kennung:	1.3.6.1.4.1.25623.1.1.10.2014.0153
Kategorie:	Mageia Linux Local Security Checks
Titel:	Mageia: Security Advisory (MGASA-2014-0153)
Zusammenfassung:	The remote host is missing an update for the 'curl' package(s) announced via the MGASA-2014-0153 advisory.
Beschreibung:	Summary: The remote host is missing an update for the 'curl' package(s) announced via the MGASA-2014-0153 advisory. Vulnerability Insight: Updated curl packages fix security vulnerabilities: Paras Sethia discovered that libcurl would sometimes mix up multiple HTTP and HTTPS connections with NTLM authentication to the same server, sending requests for one user over the connection authenticated as a different user (CVE-2014-0015). libcurl can in some circumstances re-use the wrong connection when asked to do transfers using other protocols than HTTP and FTP, causing a transfer that was initiated by an application to wrongfully re-use an existing connection to the same server that was authenticated using different credentials (CVE-2014-0138). libcurl incorrectly validates wildcard SSL certificates containing literal IP addresses, so under certain conditions, it would allow and use a wildcard match specified in the CN field, allowing a malicious server to participate in a MITM attack or just fool users into believing that it is a legitimate site (CVE-2014-0139). Affected Software/OS: 'curl' package(s) on Mageia 3, Mageia 4. Solution: Please install the updated package(s). CVSS Score: 6.4 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N
Querverweis:	Common Vulnerability Exposure (CVE) ID: CVE-2014-0015 http://archives.neohapsis.com/archives/bugtraq/2014-06/0172.html BugTraq ID: 65270 http://www.securityfocus.com/bid/65270 Bugtraq: 20141205 NEW: VMSA-2014-0012 - VMware vSphere product updates address security vulnerabilities (Google Search) http://www.securityfocus.com/archive/1/534161/100/0/threaded Debian Security Information: DSA-2849 (Google Search) http://www.debian.org/security/2014/dsa-2849 http://lists.fedoraproject.org/pipermail/package-announce/2014-February/128408.html http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127627.html http://seclists.org/fulldisclosure/2014/Dec/23 http://www.securitytracker.com/id/1029710 http://secunia.com/advisories/56728 http://secunia.com/advisories/56731 http://secunia.com/advisories/56734 http://secunia.com/advisories/56912 http://secunia.com/advisories/59458 http://secunia.com/advisories/59475 http://www.slackware.com/security/viewer.php?l=slackware-security&y=2014&m=slackware-security.502652 SuSE Security Announcement: openSUSE-SU-2014:0274 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-02/msg00066.html http://www.ubuntu.com/usn/USN-2097-1 Common Vulnerability Exposure (CVE) ID: CVE-2014-0138 Debian Security Information: DSA-2902 (Google Search) http://www.debian.org/security/2014/dsa-2902 http://secunia.com/advisories/57836 http://secunia.com/advisories/57966 http://secunia.com/advisories/57968 http://secunia.com/advisories/58615 SuSE Security Announcement: openSUSE-SU-2014:0530 (Google Search) http://lists.opensuse.org/opensuse-updates/2014-04/msg00042.html http://www.ubuntu.com/usn/USN-2167-1 Common Vulnerability Exposure (CVE) ID: CVE-2014-0139 http://www.mandriva.com/security/advisories?name=MDVSA-2015:213
Copyright	Copyright (C) 2022 Greenbone AG

Dies ist nur einer von 145615 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus. Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.