cURL/libcURL HTTP 'Location:' Redirect Security Bypass Vulnerability

Bugtraq ID:	33962
Class:	Access Validation Error
CVE:	CVE-2009-0037
Remote:	Yes
Local:	No
Published:	Mar 03 2009 12:00AM
Updated:	Apr 13 2015 09:39PM
Credit:	David Kierznowski
Vulnerable:	VMWare ESX Server 4.0 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 7.10 sparc Ubuntu Ubuntu Linux 7.10 powerpc Ubuntu Ubuntu Linux 7.10 lpia Ubuntu Ubuntu Linux 7.10 i386 Ubuntu Ubuntu Linux 7.10 amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 SuSE SUSE Linux Enterprise Server 9 SuSE SUSE Linux Enterprise Server 10 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux 11.0 Slackware Linux -current S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.3 rPath rPath Linux 2 rPath rPath Linux 1 rPath Appliance Platform Linux Service 2 rPath Appliance Platform Linux Service 1 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux WS 2.1 IA64 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux ES 2.1 IA64 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux AS 2.1 IA64 Redhat Enterprise Linux AS 2.1 Redhat Enterprise Linux Desktop version 4 Redhat Enterprise Linux 5 Server Redhat Desktop 3.0 Redhat Advanced Workstation for the Itanium Processor 2.1 Pardus Linux 2008 0 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 HP System Management Homepage 6.2.2 7 HP System Management Homepage 6.0 .96 HP System Management Homepage 3.0.2 .77 HP System Management Homepage 3.0.1 .73 HP System Management Homepage 3.0 .68 HP System Management Homepage 3.0 .64 HP System Management Homepage 6.3 HP System Management Homepage 6.2.0-12 HP System Management Homepage 6.2 HP System Management Homepage 6.2 HP System Management Homepage 6.1.0.103 HP System Management Homepage 6.1.0.102 HP System Management Homepage 6.1.0-103 HP System Management Homepage 6.1 HP System Management Homepage 6.0.0.95 HP System Management Homepage 6.0.0-95 HP System Management Homepage 6.0 HP System Management Homepage 3.0.2.77 B HP System Management Homepage 3.0.2-77 HP System Management Homepage 3.0.1-73 HP System Management Homepage 3.0.0-68 HP System Management Homepage 0 Gentoo Linux Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Daniel Stenberg curl 7.19.3 Daniel Stenberg curl 7.19 Daniel Stenberg curl 7.18 Daniel Stenberg curl 7.17 Daniel Stenberg curl 7.16.4 Daniel Stenberg curl 7.15.3 Daniel Stenberg curl 7.15.2 Daniel Stenberg curl 7.15.1 Daniel Stenberg curl 7.15 Daniel Stenberg curl 7.14.1 Daniel Stenberg curl 7.14 Daniel Stenberg curl 7.13.2 Daniel Stenberg curl 7.13.1 Daniel Stenberg curl 7.13 Daniel Stenberg curl 7.12.3 Daniel Stenberg curl 7.12.2 Daniel Stenberg curl 7.12.1 Daniel Stenberg curl 7.12 Daniel Stenberg curl 7.11.2 Daniel Stenberg curl 7.11.1 Daniel Stenberg curl 7.11 Daniel Stenberg curl 7.10.8 Daniel Stenberg curl 7.10.7 Daniel Stenberg curl 7.10.6 Daniel Stenberg curl 7.10.5 Daniel Stenberg curl 7.10.4 Daniel Stenberg curl 7.10.3 Daniel Stenberg curl 7.10.2 Daniel Stenberg curl 7.10.1 Daniel Stenberg curl 7.10 Daniel Stenberg curl 7.9.8 Daniel Stenberg curl 7.9.7 Daniel Stenberg curl 7.9.6 Daniel Stenberg curl 7.9.5 Daniel Stenberg curl 7.9.4 Daniel Stenberg curl 7.9.3 Daniel Stenberg curl 7.9.2 Daniel Stenberg curl 7.9.1 Daniel Stenberg curl 7.9 Daniel Stenberg curl 7.8.2 Daniel Stenberg curl 7.8.1 Daniel Stenberg curl 7.8 Daniel Stenberg curl 7.7.3 Daniel Stenberg curl 7.7.2 Daniel Stenberg curl 7.7.1 Daniel Stenberg curl 7.7 Daniel Stenberg curl 7.6.1 Daniel Stenberg curl 7.6 Daniel Stenberg curl 7.5.2 Daniel Stenberg curl 7.5.1 Daniel Stenberg curl 7.5 Daniel Stenberg curl 7.4.2 Daniel Stenberg curl 7.4.1 Daniel Stenberg curl 7.4 Daniel Stenberg curl 7.3 Daniel Stenberg curl 7.2.1 Daniel Stenberg curl 7.2 Daniel Stenberg curl 7.1.1 Daniel Stenberg curl 7.1 Daniel Stenberg curl 6.5.2 Daniel Stenberg curl 6.5.1 Daniel Stenberg curl 6.5 Daniel Stenberg curl 6.4 Daniel Stenberg curl 6.3.1 Daniel Stenberg curl 6.3 Daniel Stenberg curl 6.2 Daniel Stenberg curl 6.1 beta Daniel Stenberg curl 6.1 Daniel Stenberg curl 6.0 Daniel Stenberg curl 7.16.3 Daniel Stenberg curl 5.11 Avaya Voice Portal 5.0 Avaya Voice Portal 4.1 Avaya Proactive Contact 4.1 Avaya Proactive Contact 4.0 Avaya Messaging Storage Server MM3.0 Avaya Messaging Storage Server 5.0 Avaya Messaging Storage Server 4.0 Avaya Messaging Storage Server 3.1 Avaya Messaging Storage Server 2.0 Avaya Messaging Storage Server 1.0 Avaya Messaging Storage Server Avaya Message Networking MN 3.1 Avaya Message Networking 3.1 Avaya Message Networking Avaya Meeting Exchange 5.1 SP1 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 SP2 Avaya Meeting Exchange 5.0 SP1 Avaya Meeting Exchange 5.0 Avaya Intuity AUDIX LX 2.0 SP2 Avaya Intuity AUDIX LX 2.0 SP1 Avaya Intuity AUDIX LX 2.0 Avaya Intuity AUDIX LX 1.0 Avaya Communication Manager 4.0.3 SP1 Avaya Communication Manager 3.1.4 SP2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Communication Manager 2.0.1 Avaya Communication Manager 2.0 Avaya Communication Manager 1.3.1 + Avaya Communication Manager Server DEFINITY Server R10 + Avaya Communication Manager Server DEFINITY Server R10 + Avaya Communication Manager Server DEFINITY Server R11 + Avaya Communication Manager Server DEFINITY Server R9 + Avaya Communication Manager Server DEFINITY Server R9 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 + Avaya Communication Manager Server S8700 Avaya Communication Manager 1.1 + Avaya Communication Manager Server DEFINITY Server R10 + Avaya Communication Manager Server DEFINITY Server R10 + Avaya Communication Manager Server DEFINITY Server R11 + Avaya Communication Manager Server DEFINITY Server R9 + Avaya Communication Manager Server DEFINITY Server R9 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 + Avaya Communication Manager Server S8700 Avaya Communication Manager 5.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Communication Manager 5.0 SP3 Avaya Communication Manager 5.0 Avaya Communication Manager 4.0 Avaya Communication Manager 3.1 Avaya Communication Manager 3.0 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 + Avaya Communication Manager Server S8700 Avaya Communication Manager 2.2 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Communication Manager 2.1 Avaya Aura SIP Enablement Services 3.1.1 Avaya Aura SIP Enablement Services 5.1 Avaya Aura SIP Enablement Services 5.0 Avaya Aura SIP Enablement Services 3.1 Avaya Aura SIP Enablement Services 3.0 Avaya Aura Application Enablement Services 4.2.2 Avaya Aura Application Enablement Services 4.2.1 Avaya Aura Application Enablement Services 4.0.1 Avaya Aura Application Enablement Services 3.1.6 Avaya Aura Application Enablement Services 3.1.5 Avaya Aura Application Enablement Services 3.1.4 Avaya Aura Application Enablement Services 3.1.3 Avaya Aura Application Enablement Services 4.2 Avaya Aura Application Enablement Services 4.1 Avaya Aura Application Enablement Services 4.0 Avaya Aura Application Enablement Services 3.1 Avaya Aura Application Enablement Services 3.0 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.6 Apple Mac OS X 10.5
Not Vulnerable:	HP System Management Homepage 7.0 Daniel Stenberg curl 7.19.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X 10.6.3

cURL/libcURL HTTP 'Location:' Redirect Security Bypass Vulnerability

cURL/libcURL is prone to a security-bypass vulnerability.

Remote attackers can exploit this issue to bypass certain security restrictions and carry out various attacks.

This issue affects cURL/libcURL 5.11 through 7.19.3. Other versions may also be vulnerable.

cURL/libcURL HTTP 'Location:' Redirect Security Bypass Vulnerability

An attacker may exploit this issue using commonly available tools.

The following example redirection request may be used to carry out this attack:
Location: scp://name:passwd@host/a'``;date >/tmp/test``;'

cURL/libcURL HTTP 'Location:' Redirect Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 7.10 powerpc

• Ubuntu curl_7.16.4-2ubuntu1.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.16.4-2ubuntu 1.1_powerpc.deb


• Ubuntu libcurl3-dbg_7.16.4-2ubuntu1.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.16.4 -2ubuntu1.1_powerpc.deb


• Ubuntu libcurl3-gnutls_7.16.4-2ubuntu1.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.1 6.4-2ubuntu1.1_powerpc.deb


• Ubuntu libcurl3_7.16.4-2ubuntu1.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.16.4-2ub untu1.1_powerpc.deb


• Ubuntu libcurl4-gnutls-dev_7.16.4-2ubuntu1.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev _7.16.4-2ubuntu1.1_powerpc.deb


• Ubuntu libcurl4-openssl-dev_7.16.4-2ubuntu1.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-de v_7.16.4-2ubuntu1.1_powerpc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu curl_7.18.2-1ubuntu4.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.2-1ubuntu4.1_powerp c.deb


• Ubuntu curl_7.18.2-1ubuntu4.3_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.2-1ubuntu4.3_powerp c.deb


• Ubuntu libcurl3-dbg_7.18.2-1ubuntu4.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4. 1_powerpc.deb


• Ubuntu libcurl3-dbg_7.18.2-1ubuntu4.3_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4. 3_powerpc.deb


• Ubuntu libcurl3-gnutls_7.18.2-1ubuntu4.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubunt u4.1_powerpc.deb


• Ubuntu libcurl3-gnutls_7.18.2-1ubuntu4.3_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubunt u4.3_powerpc.deb


• Ubuntu libcurl3_7.18.2-1ubuntu4.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.1_po werpc.deb


• Ubuntu libcurl3_7.18.2-1ubuntu4.3_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.3_po werpc.deb


• Ubuntu libcurl4-gnutls-dev_7.18.2-1ubuntu4.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1u buntu4.1_powerpc.deb


• Ubuntu libcurl4-gnutls-dev_7.18.2-1ubuntu4.3_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1u buntu4.3_powerpc.deb


• Ubuntu libcurl4-openssl-dev_7.18.2-1ubuntu4.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1 ubuntu4.1_powerpc.deb


• Ubuntu libcurl4-openssl-dev_7.18.2-1ubuntu4.3_powerpc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1 ubuntu4.3_powerpc.deb

Debian Linux 5.0 alpha

• Debian curl_7.18.2-8lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/curl_7.18.2-8lenny 2_alpha.deb


• Debian libcurl3-dbg_7.18.2-8lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.18. 2-8lenny2_alpha.deb


• Debian libcurl3-gnutls_7.18.2-8lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7. 18.2-8lenny2_alpha.deb


• Debian libcurl3_7.18.2-8lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.18.2-8l enny2_alpha.deb


• Debian libcurl4-gnutls-dev_7.18.2-8lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-gnutls-de v_7.18.2-8lenny2_alpha.deb


• Debian libcurl4-openssl-dev_7.18.2-8lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-openssl-d ev_7.18.2-8lenny2_alpha.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu curl_7.18.2-1ubuntu4.1_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.2-1ubuntu4.1_sparc. deb


• Ubuntu curl_7.18.2-1ubuntu4.3_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/curl_7.18.2-1ubuntu4.3_sparc. deb


• Ubuntu libcurl3-dbg_7.18.2-1ubuntu4.1_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4. 1_sparc.deb


• Ubuntu libcurl3-dbg_7.18.2-1ubuntu4.3_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3-dbg_7.18.2-1ubuntu4. 3_sparc.deb


• Ubuntu libcurl3-gnutls_7.18.2-1ubuntu4.1_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubunt u4.1_sparc.deb


• Ubuntu libcurl3-gnutls_7.18.2-1ubuntu4.3_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3-gnutls_7.18.2-1ubunt u4.3_sparc.deb


• Ubuntu libcurl3_7.18.2-1ubuntu4.1_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.1_sp arc.deb


• Ubuntu libcurl3_7.18.2-1ubuntu4.3_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl3_7.18.2-1ubuntu4.3_sp arc.deb


• Ubuntu libcurl4-gnutls-dev_7.18.2-1ubuntu4.1_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1u buntu4.1_sparc.deb


• Ubuntu libcurl4-gnutls-dev_7.18.2-1ubuntu4.3_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl4-gnutls-dev_7.18.2-1u buntu4.3_sparc.deb


• Ubuntu libcurl4-openssl-dev_7.18.2-1ubuntu4.1_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1 ubuntu4.1_sparc.deb


• Ubuntu libcurl4-openssl-dev_7.18.2-1ubuntu4.3_sparc.deb
  http://ports.ubuntu.com/pool/main/c/curl/libcurl4-openssl-dev_7.18.2-1 ubuntu4.3_sparc.deb

Debian Linux 5.0 armel

• Debian curl_7.18.2-8lenny2_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/curl_7.18.2-8lenny 2_armel.deb


• Debian libcurl3-dbg_7.18.2-8lenny2_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.18. 2-8lenny2_armel.deb


• Debian libcurl3-gnutls_7.18.2-8lenny2_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7. 18.2-8lenny2_armel.deb


• Debian libcurl3_7.18.2-8lenny2_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.18.2-8l enny2_armel.deb


• Debian libcurl4-gnutls-dev_7.18.2-8lenny2_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-gnutls-de v_7.18.2-8lenny2_armel.deb


• Debian libcurl4-openssl-dev_7.18.2-8lenny2_armel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-openssl-d ev_7.18.2-8lenny2_armel.deb

Debian Linux 4.0 mips

• Debian curl_7.15.5-1etch2_mips.deb
  http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch2 _mips.deb


• Debian libcurl3-dbg_7.15.5-1etch2_mips.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15. 5-1etch2_mips.deb


• Debian libcurl3-dev_7.15.5-1etch2_all.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dev_7.15. 5-1etch2_all.deb


• Debian libcurl3-gnutls-dev_7.15.5-1etch2_mips.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-de v_7.15.5-1etch2_mips.deb


• Debian libcurl3-gnutls_7.15.5-1etch2_mips.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7. 15.5-1etch2_mips.deb


• Debian libcurl3-openssl-dev_7.15.5-1etch2_mips.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-d ev_7.15.5-1etch2_mips.deb


• Debian libcurl3_7.15.5-1etch2_mips.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1e tch2_mips.deb

Debian Linux 4.0 arm

• Debian curl_7.15.5-1etch2_arm.deb
  http://security.debian.org/pool/updates/main/c/curl/curl_7.15.5-1etch2 _arm.deb


• Debian libcurl3-dbg_7.15.5-1etch2_arm.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.15. 5-1etch2_arm.deb


• Debian libcurl3-dev_7.15.5-1etch2_all.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dev_7.15. 5-1etch2_all.deb


• Debian libcurl3-gnutls-dev_7.15.5-1etch2_arm.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls-de v_7.15.5-1etch2_arm.deb


• Debian libcurl3-gnutls_7.15.5-1etch2_arm.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7. 15.5-1etch2_arm.deb


• Debian libcurl3-openssl-dev_7.15.5-1etch2_arm.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-openssl-d ev_7.15.5-1etch2_arm.deb


• Debian libcurl3_7.15.5-1etch2_arm.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.15.5-1e tch2_arm.deb

Debian Linux 4.0 m68k

• Debian libcurl3-dev_7.15.5-1etch2_all.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dev_7.15. 5-1etch2_all.deb

Daniel Stenberg curl 5.11

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Debian Linux 5.0 hppa

• Debian curl_7.18.2-8lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/c/curl/curl_7.18.2-8lenny 2_hppa.deb


• Debian libcurl3-dbg_7.18.2-8lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.18. 2-8lenny2_hppa.deb


• Debian libcurl3-gnutls_7.18.2-8lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7. 18.2-8lenny2_hppa.deb


• Debian libcurl3_7.18.2-8lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.18.2-8l enny2_hppa.deb


• Debian libcurl4-gnutls-dev_7.18.2-8lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-gnutls-de v_7.18.2-8lenny2_hppa.deb


• Debian libcurl4-openssl-dev_7.18.2-8lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-openssl-d ev_7.18.2-8lenny2_hppa.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu curl_7.18.0-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/curl_7.18.0-1ubuntu 2.1_i386.deb


• Ubuntu libcurl3-dbg_7.18.0-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-dbg_7.18.0 -1ubuntu2.1_i386.deb


• Ubuntu libcurl3-gnutls_7.18.0-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3-gnutls_7.1 8.0-1ubuntu2.1_i386.deb


• Ubuntu libcurl3_7.18.0-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl3_7.18.0-1ub untu2.1_i386.deb


• Ubuntu libcurl4-gnutls-dev_7.18.0-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-gnutls-dev _7.18.0-1ubuntu2.1_i386.deb


• Ubuntu libcurl4-openssl-dev_7.18.0-1ubuntu2.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/c/curl/libcurl4-openssl-de v_7.18.0-1ubuntu2.1_i386.deb

Apple Mac OS X Server 10.6

• Apple MacOSXServerUpdCombo10.6.3.dmg
  http://www.apple.com/support/downloads/

Debian Linux 5.0 mipsel

• Debian curl_7.18.2-8lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/c/curl/curl_7.18.2-8lenny 2_mipsel.deb


• Debian libcurl3-dbg_7.18.2-8lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dbg_7.18. 2-8lenny2_mipsel.deb


• Debian libcurl3-gnutls_7.18.2-8lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-gnutls_7. 18.2-8lenny2_mipsel.deb


• Debian libcurl3_7.18.2-8lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3_7.18.2-8l enny2_mipsel.deb


• Debian libcurl4-gnutls-dev_7.18.2-8lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-gnutls-de v_7.18.2-8lenny2_mipsel.deb


• Debian libcurl4-openssl-dev_7.18.2-8lenny2_mipsel.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl4-openssl-d ev_7.18.2-8lenny2_mipsel.deb

Apple Mac OS X Server 10.5

• Apple SecUpdSrvr2010-002Leo.dmg
  http://www.apple.com/support/downloads/

Debian Linux 4.0 armel

• Debian libcurl3-dev_7.15.5-1etch2_all.deb
  http://security.debian.org/pool/updates/main/c/curl/libcurl3-dev_7.15. 5-1etch2_all.deb

Apple Mac OS X Server 10.5.2

• Apple SecUpdSrvr2010-002Leo.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.5.3

• Apple SecUpd2010-002Leo.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.5.6

• Apple SecUpd2010-002Leo.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.2

• Apple MacOSXServerUpd10.6.3.dmg
  http://www.apple.com/support/downloads/

Daniel Stenberg curl 6.1

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 6.3.1

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 6.5.1

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.1

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.10.1

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.10.7

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.10.8

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.18

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.19.3

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.5

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.6.1

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.7

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.7.3

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.9.3

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

Daniel Stenberg curl 7.9.7

• Daniel Stenberg curl-7.19.4.zip
  http://curl.haxx.se/download/curl-7.19.4.zip

cURL/libcURL HTTP 'Location:' Redirect Security Bypass Vulnerability

References:

• cURL Home Page (cURL)
  
• Release Notes for SSH Tectia Guardian 2.0.2b and Audit Player 2.0.13 (SSH Communication Security)
  
• ASA-2009-130 curl security update (RHSA-2009-0341) (Avaya)
  
• Security Advisory March 3 2009 (cURL)