Vulnerability in Apple Mac OS X
CVE-2011-2192
The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.
EPSS: 0.030 (85.9th percentile) — read the EPSS interpretation.
Affected products
- Apple Mac_os_x
- Haxx Libcurl
- Canonical Ubuntu_linux — versions 8.04, 10.04, 10.10
- Debian Debian_linux — versions 5.0, 6.0, 7.0
- Fedoraproject Fedora — versions 14, 15
- N/a — versions n/a
Weakness classification (CWE)
References
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_MANDRIVA)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (x_refsource_SECUNIA, Third Party Advisory, third-party-advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_FEDORA, Mailing List, Third Party Advisory)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)