SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   IBM Tivoli Composite Application Manager Vendors:   IBM
(IBM Issues Fix for IBM Tivoli Composite Application Manager) libcurl Bugs Let Remote Users Deny Service and Execute Arbitrary Code
SecurityTracker Alert ID:  1033759
SecurityTracker URL:  http://securitytracker.com/id/1033759
CVE Reference:   CVE-2015-3143, CVE-2015-3144, CVE-2015-3145   (Links to External Site)
Date:  Oct 8 2015
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 7.3, 7.4
Description:   Multiple vulnerabilities were reported in cURL. A remote user can execute arbitrary code on the target system. A remote user can cause denial of service conditions on the target system. A remote user can obtain potentially sensitive information on the target system. IBM Tivoli Composite Application Manager is affected.

When the system authenticates to a host using NTLM HTTP authentication, the system may re-use the NTLM HTTP credentials when later connecting to the same host via HTTP [CVE-2015-3143]. Paras Sethia reported this vulnerability.

A remote or local user can supply a specially crafted zero-length hostname to the application using libcurl to trigger a crash or code execution [CVE-2015-3144]. Hanno Bock reported this vulnerability.

A remote user local user can supply a specially crafted cookie value to the application using libcurl to trigger a crash or code execution [CVE-2015-3145]. Hanno Bock reported this vulnerability.

When 'Negotiate' authenticated connections are used, libcur may authenticate the entire connection rather than specific HTTP requests [CVE-2015-3148]. Isaac Boukris reported this vulnerability.

Impact:   A remote user can execute arbitrary code on the target system.

A remote user can cause denial of service conditions.

Solution:   IBM has issued a fix for CVE-2015-3143, CVE-2015-3144, and CVE-2015-3145 for IBM Tivoli Composite Application Manager.

The IBM advisory is available at:

https://www-304.ibm.com/support/docview.wss?uid=swg21903004

Vendor URL:  www-304.ibm.com/support/docview.wss?uid=swg21903004 (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (AIX), UNIX (Solaris - SunOS), Windows (Any)

Message History:   This archive entry is a follow-up to the message listed below.
May 4 2015 libcurl Bugs Let Remote Users Deny Service and Execute Arbitrary Code



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC