PT-2014-5424 · Curl+4 · Libcurl+5

Published 2014-09-10 · Updated 2024-06-15 · CVE-2014-3620

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions cURL and libcurl versions prior to 7.38.0

Description The issue allows remote attackers to bypass the Same Origin Policy and set cookies for arbitrary sites by setting a cookie for a top-level domain. This occurs because libcurl wrongly allows cookies to be set for Top Level Domains (TLDs), making them apply broader than cookies are allowed. As a result, arbitrary sites can set cookies that would then get sent to a different and unrelated site or domain.

Recommendations For versions prior to 7.38.0, update to version 7.38.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of cookies for top-level domains to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-201

CWE-310

Related Identifiers

ALT-PU-2014-2123

CVE-2014-3620

MGASA-2014-0385

OPENSUSE-SU-2014_1139-1

OPENSUSE-SU-2024:10303-1

USN-2346-1

Affected Products

Alt Linux

Junos

Suse

Ubuntu

Curl

Libcurl

References · 66

• https://osv.dev/vulnerability/openSUSE-SU-2024:10303-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-3620 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html · Vendor Advisory
• https://support.apple.com/kb/HT205031 · Vendor Advisory
• http://curl.haxx.se/docs/adv_20140910B.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0385.html · Security Note
• https://ubuntu.com/security/CVE-2014-3620 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3613 · Security Note
• https://ubuntu.com/security/CVE-2014-3613 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3620 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-2123 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2346-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0385 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html · Vendor Advisory
• http://debian.org/security/2014/dsa-3022 · Vendor Advisory