PT-2013-1237 · Curl+3 · Libcurl+4
Publicado
2013-04-12
·
Atualizado
2024-06-15
·
CVE-2013-1944
CVSS v2.0
7.5
Alta
| Vetor | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
cURL versions prior to 7.30.0
cURL versions prior to 7.34.0-r1
libcurl versions prior to 7.30.0
Description
The issue concerns a cookie leak vulnerability in cURL and libcurl, allowing remote attackers to steal cookies via a matching suffix in the domain of a URL. This vulnerability can be used to hijack sessions in targeted attacks. The vulnerability is due to a bug in the tailmatching function, which can wrongly send cookies meant for one domain when communicating with another domain that has a matching suffix.
Recommendations
For cURL versions prior to 7.30.0, update to version 7.30.0 or later to resolve the issue.
For cURL versions prior to 7.34.0-r1, update to version 7.34.0-r1 or later to resolve the issue.
As a temporary workaround, consider disabling the cookie engine in libcurl to minimize the risk of exploitation.
Restrict access to sensitive domains to prevent session hijacking until the issue is resolved.
Correção
Buffer Overflow
Information Disclosure
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Centos
Red Hat
Suse
Curl
Libcurl