NVD Vulnerability Detail

CVE-2015-3236

Summary	cURL and libcurl 7.40.0 through 7.42.1 send the HTTP Basic authentication credentials for a previous connection when reusing a reset (curl_easy_reset) connection handle to send a request to the same host name, which allows remote attackers to obtain sensitive information via unspecified vectors.
Publication Date	June 23, 2015, 4:59 a.m.
Registration Date	Jan. 26, 2021, 2:49 p.m.
Last Update	Nov. 21, 2024, 11:28 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://curl.haxx.se/docs/adv_20150617A.html	Vendor Advisory
2	http://curl.haxx.se/docs/adv_20150617A.html	Vendor Advisory
3	http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.html
4	http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160660.html
5	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	Patch Third Party Advisory
6	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html	Patch Third Party Advisory
7	http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
8	http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html
9	http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
10	http://www.oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html
11	http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html	Patch Third Party Advisory
12	http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html	Patch Third Party Advisory
13	http://www.securityfocus.com/bid/75385
14	http://www.securityfocus.com/bid/75385
15	http://www.securityfocus.com/bid/91787	Third Party Advisory VDB Entry
16	http://www.securityfocus.com/bid/91787	Third Party Advisory VDB Entry
17	https://kc.mcafee.com/corporate/index?page=content&id=SB10131
18	https://kc.mcafee.com/corporate/index?page=content&id=SB10131
19	https://security.gentoo.org/glsa/201509-02
20	https://security.gentoo.org/glsa/201509-02

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

cURL および libcurl における重要な情報を取得される脆弱性

Title	cURL および libcurl における重要な情報を取得される脆弱性
Summary	cURL および libcurl は、同じホスト名にリクエストを送るためにリセット (curl_easy_reset) 接続ハンドルを再利用する場合、以前の接続の HTTP Basic 認証の資格情報を送信するため、重要な情報を取得される脆弱性が存在します。
Possible impacts	第三者により、重要な情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 17, 2015, midnight
Registration Date	June 24, 2015, 1:58 p.m.
Last Update	Sept. 30, 2016, 9:49 a.m.

Affected System

オラクル

MySQL Enterprise Monitor 2.3.20 およびそれ以前

MySQL Enterprise Monitor 3.0.22 およびそれ以前

Oracle Enterprise Manager Ops Center 12.1.4

Oracle Enterprise Manager Ops Center 12.2.2

Oracle Enterprise Manager Ops Center 2.3.2

Haxx

cURL 7.40.0 から 7.42.1

libcurl 7.40.0 から 7.42.1

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-3236	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3236
National Vulnerability Database (NVD)
2	CVE-2015-3236	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3236

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Oracle Critical Patch Update
1	Oracle Critical Patch Update Advisory - July 2016	http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
2	Oracle Critical Patch Update Advisory - October 2015	http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html
3	Text Form of Oracle Critical Patch Update - July 2016 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpujul2016verbose-2881721.html
4	Text Form of Oracle Critical Patch Update - October 2015 Risk Matrices	http://www.oracle.com/technetwork/topics/security/cpuoct2015verbose-2367954.html
Security Advisory
5	lingering HTTP credentials in connection re-use	http://curl.haxx.se/docs/adv_20150617A.html
SECURITY BLOG
6	July 2016 Critical Patch Update Released	https://blogs.oracle.com/security/entry/july_2016_critical_patch_update
7	October 2015 Critical Patch Update Released	https://blogs.oracle.com/security/entry/october_2015_critical_patch_update

Change Log

No	Changed Details	Date of change
0	[2015年06月24日] 掲載 [2015年11月06日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - October 2015) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - October 2015 Risk Matrices) を追加ベンダ情報：オラクル (October 2015 Critical Patch Update Released) を追加 [2016年09月30日] 影響を受けるシステム：ベンダ情報の追加に伴い内容を更新ベンダ情報：オラクル (Oracle Critical Patch Update Advisory - July 2016) を追加ベンダ情報：オラクル (Text Form of Oracle Critical Patch Update - July 2016 Risk Matrices) を追加ベンダ情報：オラクル (July 2016 Critical Patch Update Released) を追加	Feb. 17, 2018, 10:37 a.m.