SB2014111803 - Multiple vulnerabilities in curl.haxx.se cURL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014111803

SB2014111803 - Multiple vulnerabilities in curl.haxx.se cURL

Published: November 18, 2014 Updated: August 9, 2020

Security Bulletin ID SB2014111803
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Cryptographic issues (CVE-ID: CVE-2014-3620)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

cURL and libcurl before 7.38.0 allow remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain.


2) Cryptographic issues (CVE-ID: CVE-2014-3613)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.


Remediation

Install update from vendor's website.

References