curl: NTLM response buffer overflow

curl: NTLM response buffer overflow curl is vulnerable to a buffer overflow which could lead to the execution of arbitrary code. curl March 16, 2005 March 16, 2005: 01 82534 remote 7.13.1 7.13.1

curl is a command line tool for transferring files via many different protocols.

curl fails to properly check boundaries when handling NTLM authentication.

With a malicious server an attacker could send a carefully crafted NTLM response to a connecting client leading to the execution of arbitrary code with the permissions of the user running curl.

Disable NTLM authentication by not using the --anyauth or --ntlm options.

All curl users should upgrade to the latest version:


    # emerge --sync
    # emerge --ask --oneshot --verbose ">=net-misc/curl-7.13.1"

CAN-2005-0490 vorlon078 lewk jaervosz