CVE-2016-0755 Auth bypass in n/a
Attackers can authenticate as other users by exploiting improper NTLM proxy connection reuse in libcurl, requiring NTLM proxy configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-0755?
CVE-2016-0755 is a high-severity authentication bypass vulnerability in Canonical Ubuntu Linux, published on 29 Jan 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ConnectionExists function in lib/url.c in libcurl before 7.47.0 does not properly re-use NTLM-authenticated proxy connections, which might allow remote attackers to authenticate as other users via a request, a similar issue to CVE-2014-0015.
Weakness: CWE-287
Which versions are affected by CVE-2016-0755?
It affects 3 products.
Linux distribution packages (17)
curl SUSE:Linux Enterprise Desktop 11 SP3 | All versions | 7.19.7-1.46.1 |
curl SUSE:Linux Enterprise Desktop 11 SP4 | All versions | 7.19.7-1.46.1 |
curl SUSE:Linux Enterprise Desktop 12 | All versions | 7.37.0-18.1 |
curl SUSE:Linux Enterprise Desktop 12 SP1 | All versions | 7.37.0-18.1 |
curl SUSE:Linux Enterprise Server 11 SP3 | All versions | 7.19.7-1.46.1 |
curl SUSE:Linux Enterprise Server 11 SP3-TERADATA | All versions | 7.19.7-1.46.1 |
curl SUSE:Linux Enterprise Server 11 SP4 | All versions | 7.19.7-1.46.1 |
curl SUSE:Linux Enterprise Server 12 | All versions | 7.37.0-18.1 |
curl SUSE:Linux Enterprise Server 12 SP1 | All versions | 7.37.0-18.1 |
curl SUSE:Linux Enterprise Server for SAP Applications 11 SP3 | All versions | 7.19.7-1.46.1 |
curl SUSE:Linux Enterprise Server for SAP Applications 11 SP4 | All versions | 7.19.7-1.46.1 |
curl SUSE:Linux Enterprise Server for SAP Applications 12 | All versions | 7.37.0-18.1 |
curl SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | All versions | 7.37.0-18.1 |
curl SUSE:Linux Enterprise Software Development Kit 11 SP3 | All versions | 7.19.7-1.46.1 |
curl SUSE:Linux Enterprise Software Development Kit 11 SP4 | All versions | 7.19.7-1.46.1 |
curl SUSE:Linux Enterprise Software Development Kit 12 | All versions | 7.37.0-18.1 |
curl SUSE:Linux Enterprise Software Development Kit 12 SP1 | All versions | 7.37.0-18.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Haxx Curl.
How do I fix CVE-2016-0755?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-0755 being exploited?
There is no known exploitation of CVE-2016-0755 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as CURL-CVE-2016-0755, DEBIAN-CVE-2016-0755, DSA-3455-1, GHSA-ff7q-9j5g-56pg, MGASA-2016-0050, SUSE-SU-2016:0340-1 and 3 more.