Mandriva Linux Security Advisory : curl (MDVSA-2015:220)
Medium Nessus Plugin ID 83244
SynopsisThe remote Mandriva Linux host is missing one or more security updates.
DescriptionUpdated curl packages fix security vulnerabilities :
NTLM-authenticated connections could be wrongly reused for requests without any credentials set, leading to HTTP requests being sent over the connection authenticated as a different user (CVE-2015-3143).
When doing HTTP requests using the Negotiate authentication method along with NTLM, the connection used would not be marked as authenticated, making it possible to reuse it and send requests for one user over the connection authenticated as a different user (CVE-2015-3148).
SolutionUpdate the affected packages.