TI-2005-03012 Aliases CVE-2005-3185 GHSA-pr2f-jh2p-p39m

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10…

MEDIUM 41CWE-119Published 2005-10-13 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: Partial · Partial · Partial
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Stack-based buffer overflow in the ntlm_output function in http-ntlm.c for (1) wget 1.10, (2) curl 7.13.2, and (3) libcurl 7.13.2, and other products that use libcurl, when NTLM authentication is enabled, allows remote servers to execute arbitrary code via a long NTLM username.

Why it matters now

EPSS 0.05188 92nd percentileScored 2026-11-07

Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:curl:curl:7.13.2:::::::*	7.13.2	Vulnerable	curl
cpe:2.3:a:libcurl:libcurl:7.13.2:::::::*	7.13.2	Vulnerable	Libcurl
cpe:2.3:a:wget:wget:1.10:::::::*	1.10	Vulnerable	Wget

cpe:2.3:a:curl:curl:7.13.2:*:*:*:*:*:*:* Versions 7.13.2 Vulnerable ·curl
cpe:2.3:a:libcurl:libcurl:7.13.2:*:*:*:*:*:*:* Versions 7.13.2 Vulnerable ·Libcurl
cpe:2.3:a:wget:wget:1.10:*:*:*:*:*:*:* Versions 1.10 Vulnerable ·Wget

Remediation

Red Hat 1 advisory

RHSA-2005:812 Released 2005-11-02 · Red Hat rating Important
wget security update
- Red Hat Desktop version 3 wget-1.10.2-0.30E, wget-1.10.2-0.30E.i386
- Red Hat Enterprise Linux AS version 3 wget-1.10.2-0.30E, wget-1.10.2-0.30E.i386, wget-1.10.2-0.30E.ia64 +1
- Red Hat Enterprise Linux AS version 4 wget-1.10.2-0.40E, wget-1.10.2-0.40E.i386, wget-1.10.2-0.40E.ia64 +1
- Red Hat Enterprise Linux Desktop version 4 wget-1.10.2-0.40E, wget-1.10.2-0.40E.i386
- Red Hat Enterprise Linux ES version 3 wget-1.10.2-0.30E, wget-1.10.2-0.30E.i386, wget-1.10.2-0.30E.ia64
- Red Hat Enterprise Linux ES version 4 wget-1.10.2-0.40E, wget-1.10.2-0.40E.i386, wget-1.10.2-0.40E.ia64
- Red Hat Enterprise Linux WS version 3 wget-1.10.2-0.30E, wget-1.10.2-0.30E.i386, wget-1.10.2-0.30E.ia64
- Red Hat Enterprise Linux WS version 4 wget-1.10.2-0.40E, wget-1.10.2-0.40E.i386, wget-1.10.2-0.40E.ia64

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Desktop version 3	Fixed	RHSA-2005:807, RHSA-2005:812
Red Hat Enterprise Linux AS version 3	Fixed	RHSA-2005:807, RHSA-2005:812
Red Hat Enterprise Linux AS version 4	Fixed	RHSA-2005:807, RHSA-2005:812
Red Hat Enterprise Linux Desktop version 4	Fixed	RHSA-2005:807, RHSA-2005:812
Red Hat Enterprise Linux ES version 3	Fixed	RHSA-2005:807, RHSA-2005:812
Red Hat Enterprise Linux ES version 4	Fixed	RHSA-2005:807, RHSA-2005:812
Red Hat Enterprise Linux WS version 3	Fixed	RHSA-2005:807, RHSA-2005:812
Red Hat Enterprise Linux WS version 4	Fixed	RHSA-2005:807, RHSA-2005:812

Timeline

2026-10-02 Threatist record created from CVE-2005-3185
2026-10-03 Alias added: GHSA-pr2f-jh2p-p39m

References

Patch 1

20051013 Multiple Vendor wget/curl NTLM Username Buffer Overflow Vulnerability

Advisory 16

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences