{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [],
  "affected_systems_content": "\u003cP\u003e\u003cTT\u003ecURL\u003c/TT\u003e versions 7.12.1 et ant\u00e9rieures.\u003c/P\u003e",
  "content": "## Description\n\ncURL est un outil en ligne de commande permettant de transf\u00e9rer des\nfichiers.\n\nUne premi\u00e8re vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire existe dans\nl\u0027authentification NTLM (NT Lan Manager).\n\nUne seconde vuln\u00e9rabilit\u00e9 de type d\u00e9bordement de m\u00e9moire existe dans\nl\u0027authentification Kerberos.\n\nUn utilisateur mal intentionn\u00e9 peut, en incitant sa victime \u00e0 se\nconnecter \u00e0 un serveur malicieux en utilisant l\u0027authentification NTLM ou\nl\u0027authentification Kerberos, ex\u00e9cuter du code arbitraire \u00e0 distance.\n\n## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2005-03-01T00:00:00",
  "last_revision_date": "2005-03-17T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 SUSE SUSE-SA:2005:011 :",
      "url": "http://www.novell.com/linux/security/advisories/2005_11_curl.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Gentoo GLSA 200503-20 du 16 mars 2005    :",
      "url": "http://www.gentoo.org/security/en/glsa/glsa-200503-20.xml"
    },
    {
      "title": "Site de cURL :",
      "url": "http://cool.haxx.se/curl/"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de FreeBSD du 27 f\u00e9vrier 2005 :",
      "url": "http://www.vuxml.org/freebsd/pkg-curl.html"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Mandrake MDKSA-2005:048 du 04 mars    2005 :",
      "url": "http://www.mandrakesoft.com/security/advisories?name=MDKSA-2005:048"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 de NetBSD :",
      "url": "ftp://ftp.netbsd.org/pub/NetBSD/packages/pkgsrc/www/curl/README.html"
    }
  ],
  "reference": "CERTA-2005-AVI-093",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2005-03-01T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Mandrake.",
      "revision_date": "2005-03-07T00:00:00.000000"
    },
    {
      "description": "ajout de la r\u00e9f\u00e9rence au bulletin de s\u00e9curit\u00e9 Gentoo.",
      "revision_date": "2005-03-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s dans cURL/libcURL permettent l\u0027ex\u00e9cution de code\narbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans cURL/libcURL",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 iDefense du 21 f\u00e9vrier 2005",
      "url": null
    }
  ]
}