SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Database)  >   MySQL Vendors:   MySQL.com, Oracle
(Oracle Issues Fix for MySQL) libcurl Bugs Let Remote Users Deny Service and Execute Arbitrary Code
SecurityTracker Alert ID:  1033906
SecurityTracker URL:  http://securitytracker.com/id/1033906
CVE Reference:   CVE-2015-3144   (Links to External Site)
Date:  Oct 21 2015
Impact:   Denial of service via network, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 2.3.20 and prior, 3.0.22 and prior
Description:   Multiple vulnerabilities were reported in cURL. A remote user can execute arbitrary code on the target system. A remote user can cause denial of service conditions on the target system. A remote user can obtain potentially sensitive information on the target system. MySQL is affected.

When the system authenticates to a host using NTLM HTTP authentication, the system may re-use the NTLM HTTP credentials when later connecting to the same host via HTTP [CVE-2015-3143]. Paras Sethia reported this vulnerability.

A remote or local user can supply a specially crafted zero-length hostname to the application using libcurl to trigger a crash or code execution [CVE-2015-3144]. Hanno Bock reported this vulnerability.

A remote user local user can supply a specially crafted cookie value to the application using libcurl to trigger a crash or code execution [CVE-2015-3145]. Hanno Bock reported this vulnerability.

When 'Negotiate' authenticated connections are used, libcur may authenticate the entire connection rather than specific HTTP requests [CVE-2015-3148]. Isaac Boukris reported this vulnerability.

Impact:   A remote user can execute arbitrary code on the target system.

A remote user can cause denial of service conditions.

Solution:   Oracle has issued a fix for CVE-2015-3144 for MySQL.

The Oracle advisory is available at:

http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html

Vendor URL:  www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry is a follow-up to the message listed below.
May 4 2015 libcurl Bugs Let Remote Users Deny Service and Execute Arbitrary Code



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC