NetSight
IP …
medium4.3

CVE-2011-2192

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegati…

Impact

The Curl_input_negotiate function in http_negotiate.c in libcurl 7.10.6 through 7.21.6, as used in curl and other products, always performs credential delegation during GSSAPI authentication, which allows remote servers to impersonate clients via GSSAPI requests.

Affected products

VendorProductAffected versions
HaxxLibcurl
from 7.10.6 through 7.21.6
AppleMac Os X
before 10.7.3
FedoraprojectFedora
Versions 14, 15
DebianDebian Linux
Versions 5.0, 6.0, 7.0
CanonicalUbuntu Linux
Versions 8.04, 10.04, 10.10, 11.04

Weakness classification

CWE-255

References