← Back to branch summary

~ubuntu-branches/ubuntu/quantal/curl/quantal-updates

« back to all changes in this revision

Viewing changes to lib/url.c

  • Committer: Package Import Robot
  • Author(s): Marc Deslauriers
  • Date: 2014-01-31 08:33:44 UTC
  • Revision ID: package-import@ubuntu.com-20140131083344-y5431zaljcif161g
Tags: 7.27.0-1ubuntu1.8
* SECURITY UPDATE: information disclosure via incorrect NTLM credential
  reuse
  - debian/patches/CVE-2014-0015.patch: don't reuse connections if NTLM
    auth is used in lib/url.c.
  - CVE-2014-0015

Show diffs side-by-side

added added

removed removed

Lines of Context:
lib/url.c
3103
3103
        }
3104
3104
        if((needle->handler->protocol & CURLPROTO_FTP) ||
3105
3105
           ((needle->handler->protocol & CURLPROTO_HTTP) &&
3106
 
            ((data->state.authhost.want==CURLAUTH_NTLM) ||
3107
 
             (data->state.authhost.want==CURLAUTH_NTLM_WB)))) {
 
3106
            ((data->state.authhost.want & CURLAUTH_NTLM) ||
 
3107
             (data->state.authhost.want & CURLAUTH_NTLM_WB)))) {
3108
3108
          /* This is FTP or HTTP+NTLM, verify that we're using the same name
3109
3109
             and password as well */
3110
3110
          if(!strequal(needle->user, check->user) ||