Scientific Linux Security Update : curl on SL6.x i386/x86_64

This script is Copyright (C) 2014 Tenable Network Security, Inc.


Synopsis :

The remote Scientific Linux host is missing one or more security
updates.

Description :

It was found that libcurl could incorrectly reuse existing connections
for requests that should have used different or no authentication
credentials, when using one of the following protocols: HTTP(S) with
NTLM authentication, LDAP(S), SCP, or SFTP. If an application using
the libcurl library connected to a remote server with certain
authentication credentials, this flaw could cause other requests to
use those same credentials. (CVE-2014-0015, CVE-2014-0138)

This update also fixes the following bugs :

- Previously, the libcurl library was closing a network
socket without first terminating the SSL connection
using the socket. This resulted in a write after close
and consequent leakage of memory dynamically allocated
by the SSL library. An upstream patch has been applied
on libcurl to fix this bug. As a result, the write after
close no longer happens, and the SSL library no longer
leaks memory.

- Previously, the libcurl library did not implement a
non-blocking SSL handshake, which negatively affected
performance of applications based on libcurl's multi
API. To fix this bug, the non-blocking SSL handshake has
been implemented by libcurl. With this update, libcurl's
multi API immediately returns the control back to the
application whenever it cannot read/write data from/to
the underlying network socket.

- Previously, the curl package could not be rebuilt from
sources due to an expired cookie in the upstream
test-suite, which runs during the build. An upstream
patch has been applied to postpone the expiration date
of the cookie, which makes it possible to rebuild the
package from sources again.

- Previously, the libcurl library attempted to
authenticate using Kerberos whenever such an
authentication method was offered by the server. This
caused problems when the server offered multiple
authentication methods and Kerberos was not the selected
one. An upstream patch has been applied on libcurl to
fix this bug. Now libcurl no longer uses Kerberos
authentication if another authentication method is
selected.

All running applications that use libcurl have to be restarted for
this update to take effect.

See also :

http://www.nessus.org/u?15f641b9

Solution :

Update the affected packages.

Risk factor :

Medium / CVSS Base Score : 6.4
(CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N)

Family: Scientific Linux Local Security Checks

Nessus Plugin ID: 74208 ()

Bugtraq ID:

CVE ID: CVE-2014-0015
CVE-2014-0138