Lucene search
F5F5:K16704HistoryMay 29, 2015 - 12:00 a.m.
K16704 : cURL and libcurl vulnerability CVE-2015-3143
2015-05-2900:00:00
my.f5.com
13
6.5 Medium
AI Score
Confidence
High
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.013 Low
EPSS
Percentile
84.6%
Security Advisory Description
cURL and libcurl 7.10.6 through 7.41.0 does not properly re-use NTLM connections, which allows remote attackers to connect as other users via an unauthenticated request, a similar issue to CVE-2014-0015.
(
CVE-2015-3143
)
Impact
Remote attackers may be able to reuse NTLM connections as other users via an unauthenticated request.
| CPE | Name | Operator | Version |
|---|---|---|---|
| big-ip afm | eq | 11.3.0 | |
| big-ip afm | eq | 11.4.0 | |
| big-ip afm | eq | 11.4.1 | |
| big-ip afm | eq | 11.5.0 | |
| big-ip afm | eq | 11.5.1 | |
| big-ip afm | eq | 11.5.2 | |
| big-ip afm | eq | 11.5.3 | |
| big-ip afm | eq | 11.5.4 | |
| big-ip afm | eq | 11.6.0 | |
| big-ip afm | eq | 11.6.1 |
Related
cve
cve
f5
f5
prion
prion
Cross site request forgery (csrf)
2015-04-24 14:59:00
Cross site request forgery (csrf)
2014-02-02 00:55:00
Design/Logic Flaw
2016-01-29 20:59:00
debiancve
debiancve
nessus
nessus
F5 Networks BIG-IP : cURL and libcurl vulnerability (K16704)
2017-04-06 00:00:00
SuSE 11.2 / 11.3 Security Update : curl (SAT Patch Numbers 8796 / 8797)
2014-02-02 00:00:00
Debian DSA-2849-1 : curl - information disclosure
2014-02-02 00:00:00
ubuntucve
ubuntucve
fedora
fedora
[SECURITY] Fedora 20 Update: curl-7.32.0-4.fc20
2014-02-03 02:46:56
[SECURITY] Fedora 20 Update: curl-7.32.0-20.fc20
2015-04-28 13:01:33
[SECURITY] Fedora 19 Update: curl-7.29.0-13.fc19
2014-02-15 20:02:19
openvas
openvas
Slackware: Security Advisory (SSA:2014-044-01)
2022-04-21 00:00:00
SUSE: Security Advisory (SUSE-SU-2014:0175-1)
2021-06-09 00:00:00
Amazon Linux: Security Advisory (ALAS-2014-295)
2015-09-08 00:00:00
securityvulns
securityvulns
[SECURITY] [DSA 2849-1] curl security update
2014-02-01 00:00:00
[ MDVSA-2015:220 ] curl
2015-05-04 00:00:00
cURL security vulnerabilitiies
2015-11-01 00:00:00
veracode
veracode
Authentication Bypass
2019-01-15 08:51:58
Reusable NTLM Connections
2018-08-13 03:10:02
CRLF Injection
2019-05-02 05:40:50
ubuntu
ubuntu
curl vulnerability
2014-02-03 00:00:00
curl vulnerabilities
2015-04-30 00:00:00
archlinux
archlinux
curl: multiple issues
2015-04-24 00:00:00
slackware
slackware
curl
2014-02-13 16:38:20
[slackware-security] curl
2015-10-29 22:48:27
debian
debian
[SECURITY] [DSA 2849-1] curl security update
2014-01-31 07:47:19
[SECURITY] [DLA 211-1] curl security update
2015-04-29 20:42:59
[SECURITY] [DSA 3232-1] curl security update
2015-04-22 12:08:24
amazon
amazon
seebug
seebug
cURL/libcURL NTLM连接远程安全限制绕过漏洞
2014-02-24 00:00:00
osv
osv
CVE-2014-0138
2014-04-15 14:55:00
curl - security update
2015-04-29 00:00:00
curl - security update
2015-04-22 00:00:00
redhat
redhat
(RHSA-2014:0561) Moderate: curl security and bug fix update
2014-05-27 00:00:00
(RHSA-2015:2159) Moderate: curl security, bug fix, and enhancement update
2015-11-19 14:41:12
(RHSA-2015:1254) Moderate: curl security, bug fix, and enhancement update
2015-07-22 05:29:46
centos
centos
curl, libcurl security update
2014-05-28 12:52:04
curl, libcurl security update
2015-07-26 14:12:23
curl, libcurl security update
2015-11-30 19:26:37
oraclelinux
oraclelinux
curl security and bug fix update
2014-05-27 00:00:00
curl security, bug fix, and enhancement update
2015-11-23 00:00:00
curl security, bug fix, and enhancement update
2015-07-28 00:00:00
alpinelinux
alpinelinux
CVE-2014-0138
2014-04-15 14:55:00
mageia
mageia
Updated curl packages fix multiple vulnerabilities
2014-04-03 04:56:35
Updated curl packages fix security vulnerabilities
2015-05-03 03:19:16
ibm
ibm
altlinux
altlinux
Security fix for the ALT Linux 8 package curl version 7.42.0-alt1
2015-04-22 00:00:00
kaspersky
kaspersky
KLA10566 Multiple vulnerabilities in cURL
2015-04-24 00:00:00
gentoo
gentoo
cURL: Multiple vulnerabilities
2015-09-24 00:00:00
vmware
vmware
VMware vSphere product updates address security vulnerabilities
2014-12-04 00:00:00
VMware vSphere product updates address security vulnerabilities
2014-12-04 00:00:00
6.5 Medium
AI Score
Confidence
High
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
0.013 Low
EPSS
Percentile
84.6%
Related for F5:K16704