|
Security holes affect multiple Linux/Unix products |
|
|
|
Source: SecuritySearch - Posted by Benjamin D. Thomas
|
Attackers could launch malicious code by exploiting vulnerabilities in a file transferring tool used in many Linux and Unix systems, according to two security firms.
Reston, Va.-based iDefense said the security holes exist in cURL/libcURL, a command line tool for transferring files with a URL syntax such as FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE and LDAP.
iDefense said the first problem is a boundary error in the "Curl_input_ntlm()" function during NT Lan Manager (NTLM) authentication. By returning an overly long response when a user unwittingly connects to a malicious server, attackers can cause a stack-based buffer overflow and launch malicious code under the privileges of the victim.
Read this full article at SecuritySearch
Powered by AkoComment! |
