USN-205-1: Curl and wget vulnerabilities

Ubuntu Security Notice USN-205-1

14th October, 2005

curl, wget vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 5.10
  • Ubuntu 5.04
  • Ubuntu 4.10

Details

A buffer overflow has been found in the NTLM authentication handler of
the Curl library and wget. By tricking an user or automatic system
that uses the Curl library, the curl application, or wget into
visiting a specially-crafted web site, a remote attacker could exploit
this to execute arbitrary code with the privileges of the calling
user.

The Ubuntu 4.10 and 5.04 versions of wget are not affected by this.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 5.10:
wget
libcurl3
libcurl2
Ubuntu 5.04:
wget
libcurl3
libcurl2
Ubuntu 4.10:
wget
libcurl3
libcurl2

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

None

References

CVE-2005-3185