CVE-2016-0755

Name of the Vulnerable Software and Affected Versions libcurl versions prior to 7.47.0

Description The issue is related to the ConnectionExists function in lib/url.c, which has weaknesses in its authentication procedure. This could allow a remote attacker to authenticate as another user by sending a request. The problem is associated with the improper re-use of NTLM-authenticated proxy connections.

Recommendations For versions prior to 7.47.0, update to version 7.47.0 or later to resolve the issue. As a temporary workaround, consider restricting access to NTLM-authenticated proxy connections to minimize the risk of exploitation. Avoid using the ConnectionExists function in lib/url.c until the issue is resolved.