CVE-2013-1944

Sažetak

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.

Reference

http://curl.haxx.se/docs/adv_20130412.html
http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102056.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102711.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104207.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104598.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105539.html
http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106606.html
http://lists.opensuse.org/opensuse-updates/2013-06/msg00013.html
http://lists.opensuse.org/opensuse-updates/2013-06/msg00016.html
http://rhn.redhat.com/errata/RHSA-2013-0771.html
http://secunia.com/advisories/53044
http://secunia.com/advisories/53051
http://secunia.com/advisories/53097
http://www.debian.org/security/2012/dsa-2660
http://www.mandriva.com/security/advisories?name=MDVSA-2013:151
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://www.osvdb.org/92316
http://www.securityfocus.com/bid/59058
http://www.ubuntu.com/usn/USN-1801-1
https://bugzilla.redhat.com/show_bug.cgi?id=950577
https://github.com/bagder/curl/commit/2eb8dcf26cb37f09cffe26909a646e702dbcab66
https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0121

CVSS

Base:	5.0
Impact:	2.9
Exploitability:	10.0

Pristup

Vektor	Složenost	Autentikacija
NETWORK	LOW	NONE

Impact

Povjerljivost	Cjelovitost	Dostupnost
PARTIAL	NONE	NONE

CVSS vektor

AV:N/AC:L/Au:N/C:P/I:N/A:N

Zadnje važnije ažuriranje

09-09-2016 - 01:59

Objavljeno

29-04-2013 - 22:55