CVE-2011-2192 Security feature bypass in n/a
libcurl always delegates credentials during GSSAPI authentication, allowing remote servers to impersonate clients and bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2011-2192?
CVE-2011-2192 is a medium-severity vulnerability in Apple Mac Os X, published on 7 Jul 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.
Weakness: CWE-255
Which versions are affected by CVE-2011-2192?
It affects 5 products.
Linux distribution packages (19)
curl Red Hat:enterprise_linux:4::as | All versions | 0:7.12.1-17.el4 |
curl-debuginfo Red Hat:enterprise_linux:4::as | All versions | 0:7.12.1-17.el4 |
curl-devel Red Hat:enterprise_linux:4::as | All versions | 0:7.12.1-17.el4 |
curl Red Hat:enterprise_linux:4::desktop | All versions | 0:7.12.1-17.el4 |
curl-debuginfo Red Hat:enterprise_linux:4::desktop | All versions | 0:7.12.1-17.el4 |
curl-devel Red Hat:enterprise_linux:4::desktop | All versions | 0:7.12.1-17.el4 |
curl Red Hat:enterprise_linux:4::es | All versions | 0:7.12.1-17.el4 |
curl-debuginfo Red Hat:enterprise_linux:4::es | All versions | 0:7.12.1-17.el4 |
curl-devel Red Hat:enterprise_linux:4::es | All versions | 0:7.12.1-17.el4 |
curl Red Hat:enterprise_linux:4::ws | All versions | 0:7.12.1-17.el4 |
curl-debuginfo Red Hat:enterprise_linux:4::ws | All versions | 0:7.12.1-17.el4 |
curl-devel Red Hat:enterprise_linux:4::ws | All versions | 0:7.12.1-17.el4 |
curl Red Hat:enterprise_linux:5::server | All versions | 0:7.15.5-9.el5_6.3 |
curl-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:7.15.5-9.el5_6.3 |
curl-devel Red Hat:enterprise_linux:5::server | All versions | 0:7.15.5-9.el5_6.3 |
curl Red Hat:enterprise_linux:6::server | All versions | 0:7.19.7-26.el6_1.1 |
curl-debuginfo Red Hat:enterprise_linux:6::server | All versions | 0:7.19.7-26.el6_1.1 |
libcurl Red Hat:enterprise_linux:6::server | All versions | 0:7.19.7-26.el6_1.1 |
libcurl-devel Red Hat:enterprise_linux:6::server | All versions | 0:7.19.7-26.el6_1.1 |
Products include Apple Mac Os X, Canonical Ubuntu Linux, Debian Debian Linux, Fedoraproject Fedora, Haxx Libcurl.
How do I fix CVE-2011-2192?
Upgrade to a fixed version.
Is CVE-2011-2192 being exploited?
There is no known exploitation of CVE-2011-2192 in the wild and no public exploit code.
Other vulnerabilities in Apple Mac Os X
Sources
Also known as CURL-CVE-2011-2192, DEBIAN-CVE-2011-2192, DSA-2271-1, GHSA-2jvc-33pv-cq2m, RHSA-2011:0918.