Docs Overview
Project
Bug Bounty Bug Report Code of conduct Dependencies Donate FAQ Features Governance History Install Known Bugs Logo TODO website Info
Protocols
CA Extract HTTP cookies HTTP/3 MQTT SSL certs SSL libs compared URL syntax WebSocket
Releases
Changelog curl CVEs Release Table Version Numbering Vulnerabilities
Tool
Comparison Table curl man page HTTP Scripting mk-ca-bundle Tutorial When options were added
Who and Why
Companies Copyright Sponsors Thanks The name
curl / Docs / curl CVEs / NTLM credentials not-checked for proxy connection re-use
Related:
Audits
Bug Bounty
Changelog
curl CVEs
JSON metadata
Vulnerability Disclosure
Vulnerabilities Table

CVE-2016-0755

NTLM credentials not-checked for proxy connection re-use

Project curl Security Advisory, January 27th 2016 - Permalink

VULNERABILITY

libcurl reuses NTLM-authenticated proxy connections without properly making sure that the connection was authenticated with the same credentials as set for this transfer.

libcurl maintains a pool of connections after a transfer has completed. The pool of connections is then gone through when a new transfer is requested and if there is a live connection available that can be reused, it is preferred instead of creating a new one.

Since NTLM-based authentication is connection oriented instead of request oriented as other HTTP based authentication, it is important that only connections that have been authenticated with the correct username + password are reused. This was done properly for server connections already, but libcurl failed to do it properly for proxy connections using NTLM.

A libcurl application can easily switch user credentials used for a proxy connection between two requests, and that subsequent transfer then MUST make libcurl use another connection. libcurl previously failed to do so.

The effects of this flaw, is that the application could be reusing a proxy connection using the previously used credentials and thus it could be given to or prevented access from resources that it was not intended to.

This problem is very similar to CVE-2014-0015, which was for direct server connections while this is for proxy connections.

INFO

This flaw can also affect the curl command line tool if a similar operation series is made with that.

The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2016-0755 to this issue.

CWE-305: Authentication Bypass by Primary Weakness

Severity: Medium

AFFECTED VERSIONS

This flaw is relevant for

libcurl is used by many applications, but not always advertised as such!

SOLUTION

In version 7.47.0, libcurl properly verifies the credentials for NTLM proxies and only reuses a connection if there there is a match.

RECOMMENDATIONS

We suggest you take one of the following actions immediately, in order of preference:

A - Upgrade curl and libcurl to version 7.47.0

B - Apply the patch to your version and rebuild

C - Avoid NTLM with proxies, or if you use NTLM with proxies, make sure you close all the libcurl handles if you ever change proxy credentials so that libcurl will not get a chance to reuse the wrong connection.

TIMELINE

It was first reported to the curl project on January 13 2016. We contacted distros@openwall on January 21.

libcurl 7.47.0 was released on January 27 2016, coordinated with the publication of this advisory.

CREDITS

Thanks a lot!