libcurl GSSAPI security vulnerability

Client's security credentials are unconditionally delegated...

[USN-1158-1] curl vulnerabilities

========================================================================== Ubuntu Security Notice USN-1158-1 June 24, 2011 curl vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubunt...

USN-1158-1: curl vulnerabilities

Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation, handing the server a copy of the client's security credential. CVE-2011-2192 Wesley Miaw discovered that when zlib is enabled, libcurl does not properly restrict the amount ...

Ubuntu: Security Advisory (USN-1158-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu Update for curl USN-1158-1

Ubuntu Update for Linux kernel vulnerabilities USN-1158-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN11581.nasl 7964 2017-12-01 07:32:11Z santu $ Ubuntu Update for curl USN-1158-1 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This...

CURL-CVE-2011-2192 inappropriate GSSAPI delegation

When doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism. This is obviously a sensitive operation, which...

CVE-2011-2192

The Curlinputnegotiate function in httpnegotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests...

cURL -- inappropriate GSSAPI delegation

cURL reports: When doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism...

Memory corruption in Postfix SMTP server Cyrus SASL support (CVE-2011-1720)

On-line version will be at http://www.postfix.org/CVE-2011-1720.html Summary ======= The Postfix SMTP server has a memory corruption error when the Cyrus SASL library is used with authentication mechanisms other than PLAIN and LOGIN the ANONYMOUS mechanism is unaffected but should not be enabled...

Fedora 14 : samba-3.5.8-74.fc14 (2011-3118)

Tue Mar 8 2011 Guenther Deschner - 3.5.8-74 - Update to 3.5.8 - resolves: 596830 - Thu Mar 3 2011 Guenther Deschner - 3.5.7-73 - Security update to 3.5.7 to address CVE-2011-0719 - resolves: 681852 - Thu Jan 6 2011 Guenther Deschner - 3.5.6-72 - Fix GSSAPI checksum for some SMB servers -...

Fedora 13 : samba-3.5.8-74.fc13 (2011-3120)

Tue Mar 8 2011 Guenther Deschner - 3.5.8-74 - Update to 3.5.8 - resolves: 617482 - Thu Mar 3 2011 Guenther Deschner - 3.5.7-73 - Security update to 3.5.7 to address CVE-2011-0719 - resolves: 681852 - Thu Jan 6 2011 Guenther Deschner - 3.5.6-72 - Fix GSSAPI checksum for some SMB servers -...

Fedora 13 : krb5-1.7.1-7.fc13 (2010-4608)

A GSSAPI-authenticated service could be remotely forced to trigger an assertion failure by sending it certain invalid messages MITKRB5-SA-2010-002, CVE-2010-0628. The included patch for adding PAM support to the bundled FTP server contained a bug which would cause the service to crash if a client...

Fedora 12 : krb5-1.7.1-6.fc12 (2010-4677)

A GSSAPI-authenticated service could be remotely forced to trigger an assertion failure by sending it certain invalid messages MITKRB5-SA-2010-002, CVE-2010-0628. The included patch for adding PAM support to the bundled FTP server contained a bug which would cause the service to crash if a client...

Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 : krb5 vulnerabilities (USN-940-1)

It was discovered that Kerberos did not correctly free memory in the GSSAPI and kdb libraries. If a remote attacker were able to manipulate an application using these libraries carefully, the service could crash, leading to a denial of service. Only Ubuntu 6.06 LTS was affected. CVE-2007-5902,...

USN-940-1: Kerberos vulnerabilities

It was discovered that Kerberos did not correctly free memory in the GSSAPI and kdb libraries. If a remote attacker were able to manipulate an application using these libraries carefully, the service could crash, leading to a denial of service. Only Ubuntu 6.06 LTS was affected. CVE-2007-5902,...

Novell NetMail 3.52d - IMAP (Authenticated) Buffer Overflow (Metasploit)

$Id: novellnetmailauth.rb 9262 2010-05-09 17:45:00Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Ubuntu Update for krb5 vulnerabilities USN-924-1

Ubuntu Update for Linux kernel vulnerabilities USN-924-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN9241.nasl 7965 2017-12-01 07:38:25Z santu $ Ubuntu Update for krb5 vulnerabilities USN-924-1 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH,...

USN-924-1: Kerberos vulnerabilities

Sol Jerome discovered that the Kerberos kadmind service did not correctly free memory. An unauthenticated remote attacker could send specially crafted traffic to crash the kadmind process, leading to a denial of service. CVE-2010-0629 It was discovered that Kerberos did not correctly free memory ...

Security fix for the ALT Linux 5 package fetchmail version 6.3.14-alt1

March 27, 2010 Andrey Rahmatullin 6.3.14-alt1 - 6.3.14 + CVE-2010-0562: heap overrun in verbose SSL cert' info display - package COPYING - remove Packager: - fix buildreqs - fix configure warnings about GSSAPI headers - fix using optflags...

Security fix for the ALT Linux 6 package fetchmail version 6.3.14-alt1

March 27, 2010 Andrey Rahmatullin 6.3.14-alt1 - 6.3.14 + CVE-2010-0562: heap overrun in verbose SSL cert' info display - package COPYING - remove Packager: - fix buildreqs - fix configure warnings about GSSAPI headers - fix using optflags...