CVE-2015-3143

What it actually does

The flaw prevents proper reuse of NTLM connections in affected libraries, allowing an unauthenticated request to reuse a prior authenticated connection and act as a different user.

Why it matters to the business

Systems relying on the affected library versions risk unauthorized access and impersonation, which can expose internal resources and increase breach likelihood; the issue has remained stable in exploitability for years with moderate prediction scores.

How an attack unfolds

An attacker identifies a service using the vulnerable library for NTLM authentication, issues an unauthenticated request that triggers improper connection reuse, and thereby connects with the identity of a previously authenticated user without supplying credentials.

How to fix it

Upgrade affected packages to the listed fixed versions: tiff (Debian:11) to 4.0.6-3, tiff (Debian:12) to 4.0.6-3, tiff (Debian:13) to 4.0.6-3, and tiff (Debian:10) to 4.0.6-3; apply equivalent patches or newer releases for any other impacted products.

How to confirm the fix worked

Confirm the installed library version matches or exceeds the fixed releases, review connection-handling code for proper NTLM reuse logic, and test with sample unauthenticated requests against authenticated sessions.

Typical attack path

1. Locate a target endpoint that uses NTLM authentication via the vulnerable library
2. Capture or infer a prior authenticated NTLM session
3. Send a crafted unauthenticated request designed to reuse the connection
4. Perform actions under the impersonated user identity

How to detect it

Review web or application server logs for sequences of unauthenticated requests immediately following authenticated NTLM sessions that originate from the same client IP or connection pool; inspect library version strings in process or package inventories.

What your security team should do

• Prioritize patching all instances listed in the fixed-versions data within the next maintenance window
• Scan the environment for any remaining pre-7.42.0 cURL or libcurl deployments even if not explicitly listed
• Update dependency manifests and rebuild containers or packages to enforce the corrected versions
• Monitor EPSS and KEV feeds for any future increase in activity around this authentication issue