VDB
CVE-2005-0490
CVE-2005-0490
PUBLISHED
CVSS 8.800000190734863 HIGH
Multiple stack-based buffer overflows in libcURL and cURL 7.12.1, and possibly other versions, allow remote malicious web servers to execute arbitrary code via base64 encoded replies that exceed the intended buffer lengths when decoded, which is not properly handled by (1) the Curl_input_ntlm function in http_ntlm.c during NTLM authentication or (2) the Curl_krb_kauth and krb4_auth functions in krb4.c during Kerberos authentication.
EPSS 5.73% · 93.0th percentile
Risk Scores
CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
5.73%
93.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| haxx | libcurl | 7.12.1 |
| haxx | curl | 7.12.1 |
Timeline
- Feb 21, 2005 CVE Published
- Feb 22, 2005 PoC Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Oct 28, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 4, 2023 EPSS Score
- May 27, 2023 EPSS Score
- Jul 19, 2023 EPSS Score
References
- oval:org.mitre.oval:def:10273 vdb
- curl-kerberos-bo(19423) vdb
- GLSA-200503-20 vendor-advisory
- RHSA-2005:340 vendor-advisory
- http://www.idefense.com/application/poi/display?id=203&type=vulnerabilities technical
- http://www.mandriva.com/security/advisories?name=MDKSA-2005:048 advisory
- http://www.securityfocus.com/bid/12616 technical
- http://marc.info/?l=full-disclosure&m=110959085507755&w=2 mailing_list
- http://www.securityfocus.com/bid/12615 technical
- https://nvd.nist.gov/vuln/detail/CVE-2005-0490 advisory
- http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000940 url
- http://www.idefense.com/application/poi/display?id=202&type=vulnerabilities url
- http://www.novell.com/linux/security/advisories/2005_11_curl.html url