Ubuntu 11.04 USN-1158-1 Critical: Curl Denial Of Service Risk

ubuntu

June 24, 2011

Multiple vulnerabilities in curl.

Summary

Multiple vulnerabilities in curl.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

Richard Silverman discovered that when doing GSSAPI authentication,

libcurl unconditionally performs credential delegation, handing the

server a copy of the client's security credential. (CVE-2011-2192)

Wesley Miaw discovered that when zlib is enabled, libcurl does not

properly restrict the amount of callback data sent to an application

that requests automatic decompression. This might allow an attacker to

cause a denial of service via an application crash or possibly execute

arbitrary code with the privilege of the application. This issue only

affected Ubuntu 8.04 LTS and Ubuntu 10.04 LTS. (CVE-2010-0734)

USN 818-1 fixed an issue with curl's handling of SSL certificates with

zero bytes in the Common Name. Due to a packaging error, the fix for

this issue was not being applied during the build. This issue only

affected Ubuntu 8.04 LTS. We apologize for the e...

Read the Full Advisory

Topics Covered

security advisory denial of service critical ubuntu curl man in the middle

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.04:
  libcurl3                        7.21.3-1ubuntu1.2
  libcurl3-gnutls                 7.21.3-1ubuntu1.2
  libcurl3-nss                    7.21.3-1ubuntu1.2

Ubuntu 10.10:
  libcurl3                        7.21.0-1ubuntu1.1
  libcurl3-gnutls                 7.21.0-1ubuntu1.1

Ubuntu 10.04 LTS:
  libcurl3                        7.19.7-1ubuntu1.1
  libcurl3-gnutls                 7.19.7-1ubuntu1.1

Ubuntu 8.04 LTS:
  libcurl3                        7.18.0-1ubuntu2.3
  libcurl3-gnutls                 7.18.0-1ubuntu2.3

After a standard system update you need to restart any applications
that make use of libcurl to make all the necessary changes.