bagder: curl-www/docs Makefile, 1.52, 1.53 _security.html, 1.9, 1.10 adv_20051013.txt, NONE, 1.1

Update of /cvsroot/curl/curl-www/docs
In directory labb:/tmp/cvs-serv25117

Modified Files:
	Makefile _security.html 
Added Files:
	adv_20051013.txt 
Log Message:
provide a html version of the (updated) advisory


Index: _security.html
===================================================================
RCS file: /cvsroot/curl/curl-www/docs/_security.html,v
retrieving revision 1.9
retrieving revision 1.10
diff -u -d -r1.9 -r1.10
--- _security.html	13 Oct 2005 18:12:27 -0000	1.9
+++ _security.html	13 Oct 2005 21:38:02 -0000	1.10
@@ -38,11 +38,13 @@
 SUBTITLE(libcurl NTLM Buffer Overflow)
 <p>
   October 13, 2005<br>
-  Mitre: CAN-2005-3185<br>
+  Mitre: <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3185">CAN-2005-3185</a><br>
   Affected versions: curl and libcurl 7.10.6 to and including 7.14.1<br>
   Not affected versions: curl and libcurl 7.10.5 and earlier, 7.15.0 and later<br>
   Patch: <a href="http://curl.haxx.se/libcurl-ntlmbuf.patch">libcurl-ntlmbuf.patch</a><br>
-  Advisory: <a href="http://curl.haxx.se/mail/lib-2005-10/0061.html">Project cURL Security Advisory</a>
+  Advisory: <a href="adv_20051013.html">Project cURL Security Advisory</a>,  <a
+  href="http://www.idefense.com/application/poi/display?id=322&type=vulnerabilities">iDEFENSE's
+  advisory</a>
 <p>
  libcurl's NTLM function can overflow a stack-based buffer if given a too long
  user name or domain name. This would happen if you enable NTLM authentication
@@ -61,9 +63,7 @@
   The <a
   href="http://article.gmane.org/gmane.comp.web.wget.general/5064">notification
   mail</a> to us about this flaw was also sent to a public wget mailing list
-  and thus became official immediately. <a
-  href="http://www.idefense.com/application/poi/display?id=322&type=vulnerabilities">iDEFENSE's
-  advisory</a>
+  and thus became official immediately.
 
 <a name="BID12616"></a>
 SUBTITLE(Kerberos Authentication Buffer Overflow)

Index: Makefile
===================================================================
RCS file: /cvsroot/curl/curl-www/docs/Makefile,v
retrieving revision 1.52
retrieving revision 1.53
diff -u -d -r1.52 -r1.53
--- Makefile	13 Jul 2005 08:01:09 -0000	1.52
+++ Makefile	13 Oct 2005 21:38:02 -0000	1.53
@@ -20,7 +20,7 @@
  httpscripting.html comparison-table.html relatedtools.html		\
  osdistribs.html versions.html history.html loc.html knownbugs.html	\
  manual.html caextract.html programs.html security.html testcurl.html \
- runtests.html libs.html
+ runtests.html libs.html adv_20051013.html
 
 all: $(PAGES)
 	@echo done 
@@ -197,6 +197,13 @@
 security.html: _security.html $(MAINPARTS)
 	$(ACTION)
 
+adv_20051013.html: _adv_20051013.html adv_20051013.t $(MAINPARTS)
+	$(ACTION)
+
+adv_20051013.t: adv_20051013.txt
+	$(TXT2PLAIN) < $< > $@
+
+
 #archive/index.html: mail
 #	./fixit
 

--- NEW FILE: adv_20051013.txt ---
                  libcurl NTLM Buffer Overflow Vulnerability
                  ==========================================

Project cURL Security Advisory, October 13th 2005
http://curl.haxx.se/docs/security.html

1. VULNERABILITY

libcurl's NTLM function can overflow a stack-based buffer if given a too long
user name or domain name. This would happen if you enable NTLM authentication
and either:

 A - pass in a user name and domain name to libcurl that together are longer
     than 192 bytes

 B - allow (lib)curl to follow HTTP "redirects" (Location: and the appropriate
     HTTP 30x response code) and the new URL contains a URL with a user name
     and domain name that together are longer than 192 bytes

There is no known exploit at the time of this writing.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name
CAN-2005-3185 to this issue.

2. AFFECTED VERSIONS

All versions of libcurl ever released with NTLM capabilities enabled are
vulnerable to this flaw.

libcurl builds with SSPI support (added in version 7.13.2 and only available
on Windows) are NOT affected.

On non-Windows machines, the NTLM support requires the lib to have been built
with OpenSSL support. Therefore: libcurl builds without SSL support or SSL
support provided by GnuTLS are NOT affected.

Affected versions: curl and libcurl 7.10.6 to and including 7.14.1
Not affected versions: curl and libcurl 7.10.5 and earlier, 7.15.0 and later

Also note that (lib)curl is used by many applications, and not always
advertised as such.

3. RECOMMENDATIONS

We *strongly* suggest you take one of the following actions immediately:

 I - Upgrade to curl and libcurl 7.15.0

 II - Apply the patch http://curl.haxx.se/libcurl-ntlmbuf.patch to your
      libcurl version and install this.

 III - Disable NTLM either by not enabling the command line option (to curl)
       or by not using the NTLM-enabling options with libcurl.

4. TIME LINE

We were notified by iDEFENSE at 22:15 local time October 12th 2005.

The notification mail was also sent to the wget camp (as they share pretty
much the same source and thus the same flaw). The mail to the wget project was
sent to a mail alias that is forwarded to a public mailing list with public
archives etc.

The patch was produced within 30 minutes.

A number of distributors and packagers of curl were notified the same evening
and early morning October 13th.

Mailed vendor-sec 09:00 on October 13th

I noticed the "leak" of this flaw at 09:50 October 13th and mailed vendor-sec
about it.

At 10:50 October 13th, the advisory was posted to the curl-users and
curl-library mailing list and then curl 7.15.0 was already relased and
available for download.

5. CREDITS

Reported to us by iDEFENSE, original discoverer is anonymous