CVE-2015-3148

Published: Apr 24, 2015Modified: May 6, 2026

5.0

Vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability: 10.0 / Impact: 2.9

Source: NVD

Description

cURL and libcurl 7.10.6 through 7.41.0 do not properly re-use authenticated Negotiate connections, which allows remote attackers to connect as other users via a request.

Affected (159)

Products: Fedoraproject: Fedora · Canonical: Ubuntu Linux · Debian: Debian Linux · +4 more

Show all products

Fedoraproject: Fedora · Canonical: Ubuntu Linux · Debian: Debian Linux · Apple: Mac Os X · Haxx: Libcurl, Curl · Hp: System Management Homepage · Opensuse: Opensuse

1 product

1 product

1 product

1 product

2 products

1 product

System Management Homepage

Opensuse

1 product

Opensuse

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 21
Fedoraproject Fedora	Version 22

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 12.04
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 14.10
Canonical Ubuntu Linux	Version 15.04
Debian Debian Linux	Version 7.0

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Apple Mac Os X	Version 10.10.0
Apple Mac Os X	Version 10.10.1
Apple Mac Os X	Version 10.10.2
Apple Mac Os X	Version 10.10.3
Apple Mac Os X	Version 10.10.4

Configuration D

72 vulnerable

Vulnerable Software	Affected Versions
Haxx Libcurl	Version 7.10.6
Haxx Libcurl	Version 7.10.7
Haxx Libcurl	Version 7.10.8
Haxx Libcurl	Version 7.11.0
Haxx Libcurl	Version 7.11.1
Haxx Libcurl	Version 7.11.2
Haxx Libcurl	Version 7.12.0
Haxx Libcurl	Version 7.12.1
Haxx Libcurl	Version 7.12.2
Haxx Libcurl	Version 7.12.3
Haxx Libcurl	Version 7.13.0
Haxx Libcurl	Version 7.13.1
Haxx Libcurl	Version 7.13.2
Haxx Libcurl	Version 7.14.0
Haxx Libcurl	Version 7.14.1
Haxx Libcurl	Version 7.15.0
Haxx Libcurl	Version 7.15.1
Haxx Libcurl	Version 7.15.2
Haxx Libcurl	Version 7.15.3
Haxx Libcurl	Version 7.15.4
Haxx Libcurl	Version 7.15.5
Haxx Libcurl	Version 7.16.0
Haxx Libcurl	Version 7.16.1
Haxx Libcurl	Version 7.16.2
Haxx Libcurl	Version 7.16.3
Haxx Libcurl	Version 7.16.4
Haxx Libcurl	Version 7.17.0
Haxx Libcurl	Version 7.17.1
Haxx Libcurl	Version 7.18.0
Haxx Libcurl	Version 7.18.1
Haxx Libcurl	Version 7.18.2
Haxx Libcurl	Version 7.19.0
Haxx Libcurl	Version 7.19.1
Haxx Libcurl	Version 7.19.2
Haxx Libcurl	Version 7.19.3
Haxx Libcurl	Version 7.19.4
Haxx Libcurl	Version 7.19.5
Haxx Libcurl	Version 7.19.6
Haxx Libcurl	Version 7.19.7
Haxx Libcurl	Version 7.20.0
Haxx Libcurl	Version 7.20.1
Haxx Libcurl	Version 7.21.0
Haxx Libcurl	Version 7.21.1
Haxx Libcurl	Version 7.21.2
Haxx Libcurl	Version 7.21.3
Haxx Libcurl	Version 7.21.4
Haxx Libcurl	Version 7.21.5
Haxx Libcurl	Version 7.21.6
Haxx Libcurl	Version 7.21.7
Haxx Libcurl	Version 7.22.0
Haxx Libcurl	Version 7.23.0
Haxx Libcurl	Version 7.23.1
Haxx Libcurl	Version 7.24.0
Haxx Libcurl	Version 7.25.0
Haxx Libcurl	Version 7.26.0
Haxx Libcurl	Version 7.27.0
Haxx Libcurl	Version 7.28.0
Haxx Libcurl	Version 7.28.1
Haxx Libcurl	Version 7.29.0
Haxx Libcurl	Version 7.30.0
Haxx Libcurl	Version 7.31.0
Haxx Libcurl	Version 7.32.0
Haxx Libcurl	Version 7.33.0
Haxx Libcurl	Version 7.34.0
Haxx Libcurl	Version 7.35.0
Haxx Libcurl	Version 7.36.0
Haxx Libcurl	Version 7.37.0
Haxx Libcurl	Version 7.37.1
Haxx Libcurl	Version 7.38.0
Haxx Libcurl	Version 7.39
Haxx Libcurl	Version 7.40.0
Haxx Libcurl	Version 7.41.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Hp System Management Homepage	Up to 7.5.3.1

Configuration F

72 vulnerable

Vulnerable Software	Affected Versions
Haxx Curl	Version 7.10.6
Haxx Curl	Version 7.10.7
Haxx Curl	Version 7.10.8
Haxx Curl	Version 7.11.0
Haxx Curl	Version 7.11.1
Haxx Curl	Version 7.11.2
Haxx Curl	Version 7.12.0
Haxx Curl	Version 7.12.1
Haxx Curl	Version 7.12.2
Haxx Curl	Version 7.12.3
Haxx Curl	Version 7.13.0
Haxx Curl	Version 7.13.1
Haxx Curl	Version 7.13.2
Haxx Curl	Version 7.14.0
Haxx Curl	Version 7.14.1
Haxx Curl	Version 7.15.0
Haxx Curl	Version 7.15.1
Haxx Curl	Version 7.15.2
Haxx Curl	Version 7.15.3
Haxx Curl	Version 7.15.4
Haxx Curl	Version 7.15.5
Haxx Curl	Version 7.16.0
Haxx Curl	Version 7.16.1
Haxx Curl	Version 7.16.2
Haxx Curl	Version 7.16.3
Haxx Curl	Version 7.16.4
Haxx Curl	Version 7.17.0
Haxx Curl	Version 7.17.1
Haxx Curl	Version 7.18.0
Haxx Curl	Version 7.18.1
Haxx Curl	Version 7.18.2
Haxx Curl	Version 7.19.0
Haxx Curl	Version 7.19.1
Haxx Curl	Version 7.19.2
Haxx Curl	Version 7.19.3
Haxx Curl	Version 7.19.4
Haxx Curl	Version 7.19.5
Haxx Curl	Version 7.19.6
Haxx Curl	Version 7.19.7
Haxx Curl	Version 7.20.0
Haxx Curl	Version 7.20.1
Haxx Curl	Version 7.21.0
Haxx Curl	Version 7.21.1
Haxx Curl	Version 7.21.2
Haxx Curl	Version 7.21.3
Haxx Curl	Version 7.21.4
Haxx Curl	Version 7.21.5
Haxx Curl	Version 7.21.6
Haxx Curl	Version 7.21.7
Haxx Curl	Version 7.22.0
Haxx Curl	Version 7.23.0
Haxx Curl	Version 7.23.1
Haxx Curl	Version 7.24.0
Haxx Curl	Version 7.25.0
Haxx Curl	Version 7.26.0
Haxx Curl	Version 7.27.0
Haxx Curl	Version 7.28.0
Haxx Curl	Version 7.28.1
Haxx Curl	Version 7.29.0
Haxx Curl	Version 7.30.0
Haxx Curl	Version 7.31.0
Haxx Curl	Version 7.32.0
Haxx Curl	Version 7.33.0
Haxx Curl	Version 7.34.0
Haxx Curl	Version 7.35.0
Haxx Curl	Version 7.36.0
Haxx Curl	Version 7.37.0
Haxx Curl	Version 7.37.1
Haxx Curl	Version 7.38.0
Haxx Curl	Version 7.39.0
Haxx Curl	Version 7.40.0
Haxx Curl	Version 7.41.0

Configuration G

2 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 13.1
Opensuse Opensuse	Version 13.2

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (46)

http://advisories.mageia.org/MGASA-2015-0179.html

Source: secalert@redhat.com

Third Party Advisory

http://curl.haxx.se/docs/adv_20150422B.html

Source: secalert@redhat.com

Vendor Advisory

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10743

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html

Source: secalert@redhat.com

Mailing ListVendor Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-April/155957.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-April/156250.html

Source: secalert@redhat.com

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/156945.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157017.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157188.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-04/msg00057.html

Source: secalert@redhat.com

http://marc.info/?l=bugtraq&m=145612005512270&w=2

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2015-1254.html

Source: secalert@redhat.com

http://www.debian.org/security/2015/dsa-3232

Source: secalert@redhat.com

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDVSA-2015:219

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2015:220

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/74301

Source: secalert@redhat.com

http://www.securitytracker.com/id/1032232

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-2591-1

Source: secalert@redhat.com

Third Party Advisory

https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05045763

Source: secalert@redhat.com

Vendor Advisory

https://security.gentoo.org/glsa/201509-02

Source: secalert@redhat.com

https://support.apple.com/kb/HT205031

Source: secalert@redhat.com

Vendor Advisory

http://advisories.mageia.org/MGASA-2015-0179.html