Test ID:	1.3.6.1.4.1.25623.1.0.55626
Category:	Mandrake Local Security Checks
Title:	Mandrake Security Advisory MDKSA-2005:183 (wget)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to wget announced via advisory MDKSA-2005:183. A vulnerability in libcurl's NTLM function can overflow a stack-based buffer if given too long a user name or domain name in NTLM authentication is enabled and either a) pass a user and domain name to libcurl that together are longer than 192 bytes or b) allow (lib)curl to follow HTTP redirects and the new URL contains a URL with a user and domain name that together are longer than 192 bytes. Wget, as of version 1.10, uses the NTLM code from libcurl and is also vulnerable to this issue. The updated packages have been patched to address this issue. Affected versions: 2006.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. https://secure1.securityspace.com/smysecure/catid.html?in=MDKSA-2005:183 http://curl.haxx.se/mail/lib-2005-10/0061.html Risk factor : High CVSS Score: 7.5
Cross-Ref:	BugTraq ID: 15647 BugTraq ID: 15102 Common Vulnerability Exposure (CVE) ID: CVE-2005-3185 http://docs.info.apple.com/article.html?artnum=302847 http://www.securityfocus.com/bid/15102 http://www.securityfocus.com/bid/15647 Debian Security Information: DSA-919 (Google Search) http://www.debian.org/security/2005/dsa-919 http://www.redhat.com/archives/fedora-announce-list/2005-October/msg00055.html http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00020.html http://www.gentoo.org/security/en/glsa/glsa-200510-19.xml http://www.idefense.com/application/poi/display?id=322&type=vulnerabilities http://www.mandriva.com/security/advisories?name=MDKSA-2005:182 http://www.osvdb.org/20011 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9810 http://www.redhat.com/support/errata/RHSA-2005-807.html http://www.redhat.com/support/errata/RHSA-2005-812.html SCO Security Bulletin: SCOSA-2006.10 ftp://ftp.sco.com/pub/updates/OpenServer/SCOSA-2006.10/SCOSA-2006.10.txt http://securitytracker.com/id?1015056 http://securitytracker.com/id?1015057 http://secunia.com/advisories/17192 http://secunia.com/advisories/17193 http://secunia.com/advisories/17203 http://secunia.com/advisories/17208 http://secunia.com/advisories/17228 http://secunia.com/advisories/17247 http://secunia.com/advisories/17297 http://secunia.com/advisories/17320 http://secunia.com/advisories/17400 http://secunia.com/advisories/17403 http://secunia.com/advisories/17485 http://secunia.com/advisories/17813 http://secunia.com/advisories/17965 http://secunia.com/advisories/19193 http://slackware.com/security/viewer.php?l=slackware-security&y=2005&m=slackware-security.519010 http://securityreason.com/securityalert/82 SuSE Security Announcement: SUSE-SA:2005:063 (Google Search) http://www.novell.com/linux/security/advisories/2005_63_wget_curl.html http://lists.trustix.org/pipermail/tsl-announce/2005-October/000354.html https://usn.ubuntu.com/205-1/ http://www.vupen.com/english/advisories/2005/2088 http://www.vupen.com/english/advisories/2005/2125 http://www.vupen.com/english/advisories/2005/2659 XForce ISS Database: wget-curl-ntlm-username-bo(22721) https://exchange.xforce.ibmcloud.com/vulnerabilities/22721
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.