#VU33107 Information disclosure in cURL - CVE-2013-1944
Published: April 30, 2013 / Updated: August 3, 2020
Vulnerability identifier: #VU33107
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2013-1944
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
cURL
cURL
Software vendor:
curl.haxx.se
curl.haxx.se
Description
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. Per http://www.ubuntu.com/usn/USN-1801-1/ "A security issue affects these releases of Ubuntu and its derivatives: Ubuntu 12.10 Ubuntu 12.04 LTS Ubuntu 11.10 Ubuntu 10.04 LTS Ubuntu 8.04 LTS"
Remediation
Install update from vendor's website.
External links
- http://curl.haxx.se/docs/adv_20130412.html
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102056.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102711.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104207.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104598.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105539.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106606.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00013.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00016.html
- http://rhn.redhat.com/errata/RHSA-2013-0771.html
- http://secunia.com/advisories/53044
- http://secunia.com/advisories/53051
- http://secunia.com/advisories/53097
- http://www.debian.org/security/2012/dsa-2660
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:151
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
- http://www.osvdb.org/92316
- http://www.securityfocus.com/bid/59058
- http://www.ubuntu.com/usn/USN-1801-1
- https://bugzilla.redhat.com/show_bug.cgi?id=950577
- https://github.com/bagder/curl/commit/2eb8dcf26cb37f09cffe26909a646e702dbcab66
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0121