CVE-2013-1944

Description

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.

References

https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0121

https://github.com/bagder/curl/commit/2eb8dcf26cb37f09cffe26909a646e702dbcab66

https://bugzilla.redhat.com/show_bug.cgi?id=950577

http://www.ubuntu.com/usn/USN-1801-1

http://www.securityfocus.com/bid/59058

http://www.osvdb.org/92316

http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

http://www.mandriva.com/security/advisories?name=MDVSA-2013:151

http://www.debian.org/security/2012/dsa-2660

http://secunia.com/advisories/53097

http://secunia.com/advisories/53051

http://secunia.com/advisories/53044

http://rhn.redhat.com/errata/RHSA-2013-0771.html

http://lists.opensuse.org/opensuse-updates/2013-06/msg00016.html

http://lists.opensuse.org/opensuse-updates/2013-06/msg00013.html

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106606.html

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105539.html

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104598.html

http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104207.html

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102711.html

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102056.html

http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html

http://curl.haxx.se/docs/adv_20130412.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3