—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2014:110
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : curl
Date : June 10, 2014
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Updated curl packages fix security vulnerabilities:

Paras Sethia discovered that libcurl would sometimes mix up multiple
HTTP and HTTPS connections with NTLM authentication to the same server,
sending requests for one user over the connection authenticated as
a different user (CVE-2014-0015).

libcurl can in some circumstances re-use the wrong connection when
asked to do transfers using other protocols than HTTP and FTP, causing
a transfer that was initiated by an application to wrongfully re-use
an existing connection to the same server that was authenticated
using different credentials (CVE-2014-0138).

libcurl incorrectly validates wildcard SSL certificates containing
literal IP addresses, so under certain conditions, it would allow
and use a wildcard match specified in the CN field, allowing a
malicious server to participate in a MITM attack or just fool users
into believing that it is a legitimate site (CVE-2014-0139).
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0015
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0138
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0139
http://advisories.mageia.org/MGASA-2014-0153.html
_______________________________________________________________________

Updated Packages:

Mandriva Enterprise Server 5:
dbfc65c19ac0479b0f171fb2f57b7009 mes5/i586/curl-7.19.0-2.9mdvmes5.2.i586.rpm
329ea6986634f8115f0f40189dafa13d mes5/i586/curl-examples-7.19.0-2.9mdvmes5.2.i586.rpm
e90929468892b409168cbaaf5ccf7aa7 mes5/i586/libcurl4-7.19.0-2.9mdvmes5.2.i586.rpm
b76ba081a80e5305b3ea502331d339f1 mes5/i586/libcurl-devel-7.19.0-2.9mdvmes5.2.i586.rpm
079bba263ad5eba412c40e97b088ff49 mes5/SRPMS/curl-7.19.0-2.9mdvmes5.2.src.rpm

Mandriva Enterprise Server 5/X86_64:
d51a98de165924c8eb83db16cd2a9de1 mes5/x86_64/curl-7.19.0-2.9mdvmes5.2.x86_64.rpm
2d6dba13c1b95fe669eeee6ef618e6d2 mes5/x86_64/curl-examples-7.19.0-2.9mdvmes5.2.x86_64.rpm
3e92dcf0f85218afd68cdf12b81b7639 mes5/x86_64/lib64curl4-7.19.0-2.9mdvmes5.2.x86_64.rpm
035cea9d1c4d9f30e442113c1890da29 mes5/x86_64/lib64curl-devel-7.19.0-2.9mdvmes5.2.x86_64.rpm
079bba263ad5eba412c40e97b088ff49 mes5/SRPMS/curl-7.19.0-2.9mdvmes5.2.src.rpm

Mandriva Business Server 1/X86_64:
59896a7f65dc52adff833b191c2ccd8d mbs1/x86_64/curl-7.24.0-3.5.mbs1.x86_64.rpm
c519acfcdfd464dce34e5d85642cddae mbs1/x86_64/curl-examples-7.24.0-3.5.mbs1.x86_64.rpm
c9c4ccf43b0115c3faf24ae6c0a4ef51 mbs1/x86_64/lib64curl4-7.24.0-3.5.mbs1.x86_64.rpm
9d8d2a5cbffd1ba844d1a6c7837f2298 mbs1/x86_64/lib64curl-devel-7.24.0-3.5.mbs1.x86_64.rpm
9dbb683a4ebda2ad649562fd66c9cb87 mbs1/SRPMS/curl-7.24.0-3.5.mbs1.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg –recv-keys –keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/en/support/security/advisories/

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFTlqBfmqjQ0CJFipgRAnnBAJ4iIKbK1jBxAtipngM1xlSflmpTUQCgsxIE
SB5lxqgllGcXWEW9SyPo/Fw=
=hggz
—–END PGP SIGNATURE—–

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://store.mandriva.com
_______________________________________________________