SB2014091806 - Amazon Linux AMI update for curl

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014091806

SB2014091806 - Amazon Linux AMI update for curl

Published: September 18, 2014

Security Bulletin ID SB2014091806
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Cryptographic issues (CVE-ID: CVE-2014-3613)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.


2) Cryptographic issues (CVE-ID: CVE-2014-3620)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.


Remediation

Install update from vendor's website.

References