HTTP: Large Authentication Response

This signature detects overly long NTLM authentication responses. A malicious server can respond with a large HTTP header to overflow client-side buffers. Several versions of cURL are vulnerable to this type of attack. A successful attack can allow code execution.

Extended Description

It has been reported that cURL and libcURL are vulnerable to a remotely exploitable stack-based buffer overflow vulnerability. The cURL and libcURL NTML response processing code fails to ensure that a buffer overflow cannot occur when response data is decoded. The overflow occurs in the stack region, and remote code execution is possible if the saved instruction pointer is overwritten with a pointer to embedded instructions.

Affected Products

F5 3-dns,Suse linux_desktop

References

BugTraq: 12615

CVE: CVE-2005-0490

URL: http://curl.haxx.se/ http://www.securitytracker.com/alerts/2005/Feb/1013253.html http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities&flashstatus=true

Short Name

HTTP:STC:SRVRSP:AUTH-RESP-OF

Severity

Warning

Recommended

False

Recommended Action

None

HTTP: Large Authentication Response

Extended Description

Affected Products

References

Found a potential security threat?