Vulnerability Description
The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Haxx | Curl | <= 7.29.0 |
| Haxx | Libcurl | <= 7.29.0 |
| Canonical | Ubuntu Linux | 8.04 |
Related Weaknesses (CWE)
References
- http://curl.haxx.se/docs/adv_20130412.htmlVendor Advisory
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102056.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102711.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104207.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104598.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105539.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106606.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00013.html
- http://lists.opensuse.org/opensuse-updates/2013-06/msg00016.html
- http://rhn.redhat.com/errata/RHSA-2013-0771.html
- http://secunia.com/advisories/53044Vendor Advisory
- http://secunia.com/advisories/53051Vendor Advisory
- http://secunia.com/advisories/53097Vendor Advisory
- http://www.debian.org/security/2012/dsa-2660
FAQ
What is CVE-2013-1944?
CVE-2013-1944 is a vulnerability with a CVSS score of 5.0 (MEDIUM). The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix ...
How severe is CVE-2013-1944?
CVE-2013-1944 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-1944?
Check the references section above for vendor advisories and patch information. Affected products include: Haxx Curl, Haxx Libcurl, Canonical Ubuntu Linux.