CVE:CVE-2019-3822
CNNVD:CNNVD-201902-124
Haxx libcurl是瑞典Haxx公司的一筐开源的客户端URL传输库。该产品支持FTP、SFTP、TFTP和HTTP等协议。
libcurl 7.36.0版本至7.64.0版本中的‘lib/vauth/ntlm.c:Curl_auth_create_ntlm_type3_message’函数存在基于堆栈的缓冲区溢出漏洞。远程攻击者可利用该漏洞造成拒绝服务或可能执行任意代码。
solution:Upgrade haxx libcurl to a higher version than 7.64.0,and avoid the version [7.36.0,7.64.0); Upgrade canonical ubuntu_linux to a higher version than 14.04,16.04,18.04,18.10,and avoid the version 14.04,16.04,18.04,18.10; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; netapp active_iq_unified_manager avoid the version [7.3,),[9.5,),no fixed version after 7.3,no fixed version after 9.5; Upgrade netapp clustered_data_ontap to a higher version than *; Upgrade netapp oncommand_insight to a higher version than -; Upgrade netapp oncommand_workflow_automation to a higher version than -; Upgrade netapp snapcenter to a higher version than -; Upgrade siemens sinema_remote_connect_client to a higher version than 2.0,and avoid the version (,2.0]; Upgrade oracle communications_operations_monitor to a higher version than 3.4,4.0,and avoid the version 3.4,4.0; Upgrade oracle enterprise_manager_ops_center to a higher version than 12.3.3,12.4.0,and avoid the version 12.3.3,12.4.0; Upgrade oracle http_server to a higher version than 12.2.1.3.0,and avoid the version 12.2.1.3.0; Upgrade oracle mysql_server to a higher version than 5.7.26,8.0.15,and avoid the version (,5.7.26],[5.7.27,8.0.15]; Upgrade oracle secure_global_desktop to a higher version than 5.4,and avoid the version 5.4; Upgrade oracle services_tools_bundle to a higher version than 19.2,and avoid the version 19.2; Upgrade redhat enterprise_linux to a higher version than 8.0,and avoid the version 8.0