From owner-svn-ports-all@FreeBSD.ORG Tue May 26 22:15:06 2015 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 8A96EB93; Tue, 26 May 2015 22:15:06 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id 6B197C80; Tue, 26 May 2015 22:15:06 +0000 (UTC) (envelope-from delphij@FreeBSD.org) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.9/8.14.9) with ESMTP id t4QMF6E9019187; Tue, 26 May 2015 22:15:06 GMT (envelope-from delphij@FreeBSD.org) Received: (from delphij@localhost) by svn.freebsd.org (8.14.9/8.14.9/Submit) id t4QMF6Rh019185; Tue, 26 May 2015 22:15:06 GMT (envelope-from delphij@FreeBSD.org) Message-Id: <201505262215.t4QMF6Rh019185@svn.freebsd.org> X-Authentication-Warning: svn.freebsd.org: delphij set sender to delphij@FreeBSD.org using -f From: Xin LI Date: Tue, 26 May 2015 22:15:06 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r387514 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 26 May 2015 22:15:06 -0000 Author: delphij Date: Tue May 26 22:15:05 2015 New Revision: 387514 URL: https://svnweb.freebsd.org/changeset/ports/387514 Log: Retrofit document cURL multiple vulnerabilities. Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Tue May 26 19:56:58 2015 (r387513) +++ head/security/vuxml/vuln.xml Tue May 26 22:15:05 2015 (r387514) @@ -57,6 +57,113 @@ Notes: --> + + cURL -- sensitive HTTP server headers also sent to proxies + + + curl + 7.42.1 + + + + +

cURL reports:

+
libcurl provides applications a way to set custom HTTP + headers to be sent to the server by using CURLOPT_HTTPHEADER. + A similar option is available for the curl command-line + tool with the '--header' option.
+
When the connection passes through an HTTP proxy the + same set of headers is sent to the proxy as well by default. + While this is by design, it has not necessarily been clear + nor understood by application programmers.
+

+ + + + CVE-2015-3153 + http://curl.haxx.se/docs/adv_20150429.html + + + 2015-04-29 + 2015-05-26 + + + + + cURL -- multiple vulnerabilities + + + curl + 7.42.0 + + + + +

cURL reports:

+
libcurl keeps a pool of its last few connections around + after use to fascilitate easy, conventient and completely + transparent connection re-use for applications.
+
When doing HTTP requests NTLM authenticated, the entire + connnection becomes authenticated and not just the + specific HTTP request which is otherwise how HTTP works. + This makes NTLM special and a subject for special + treatment in the code. With NTLM, once the connection is + authenticated, no further authentication is necessary until + the connection gets closed.
+

+
When doing HTTP requests Negotiate authenticated, the + entire connnection may become authenticated and not just + the specific HTTP request which is otherwise how HTTP + works, as Negotiate can basically use NTLM under the hood. + curl was not adhering to this fact but would assume that + such requests would also be authenticated per request.
+

+
libcurl supports HTTP "cookies" as documented in RFC 6265. + Together with each individual cookie there are several + different properties, but for this vulnerability we + focus on the associated "path" element. It tells + information about for which path on a given host the + cookies is valid.
+
The internal libcurl function called sanitize_cookie_path() + that cleans up the path element as given to it from a + remote site or when read from a file, did not properly + validate the input. If given a path that consisted of a + single double-quote, libcurl would index a newly + allocated memory area with index -1 and assign a zero + to it, thus destroying heap memory it wasn't supposed to.
+

+
There is a private function in libcurl called fix_hostname() + that removes a trailing dot from the host name if there is + one. The function is called after the host name has been + extracted from the URL libcurl has been told to act on.
+
If a URL is given with a zero-length host name, like in + "http://:80" or just ":80", fix_hostname() will index the + host name pointer with a -1 offset (as it blindly assumes + a non-zero length) and both read and assign that address.
+

+ + + + http://curl.haxx.se/docs/adv_20150422A.html + http://curl.haxx.se/docs/adv_20150422B.html + http://curl.haxx.se/docs/adv_20150422C.html + http://curl.haxx.se/docs/adv_20150422D.html + CVE-2014-3143 + CVE-2014-3144 + CVE-2014-3145 + CVE-2014-3148 + + + 2015-04-22 + 2015-05-26 + + + cassandra -- remote execution of arbitrary code