CVE:CVE-2011-2192
CNNVD:CNNVD-201106-322
HAXX Haxx libcurl是瑞典HAXX公司的一个免费、开源的客户端URL传输库。该库支持FTP、FTPS、TFTP、HTTP等。
libcurl 7.10.6至7.21.6版本存在信任管理问题漏洞，该漏洞源于http_negotiate.c中的Curl_input_negotiate函数在GSSAPI认证过程中无条件地执行认证授权。远程攻击者可借助GSSAPI请求进行欺骗攻击，获取客户端的安全证书，恶意服务器可通过使用相同的GSSAPI机制来模仿其他服务器的客户端。
solution:Upgrade haxx libcurl to a higher version than 7.21.6,and avoid the version [7.10.6,7.21.6]; Upgrade apple mac_os_x to a higher version than 10.7.3,and avoid the version (,10.7.3); Upgrade fedoraproject fedora to a higher version than 14,15,and avoid the version 14,15; Upgrade debian debian_linux to a higher version than 5.0,6.0,7.0,and avoid the version 5.0,6.0,7.0; Upgrade canonical ubuntu_linux to a higher version than 8.04,10.04,10.10,11.04,and avoid the version 8.04,10.04,10.10,11.04