Published: 29/04/2013 Updated: 09/09/2016

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

The tailMatch function in cookie.c in cURL and libcurl prior to 7.30.0 does not properly match the path domain when sending cookies, which allows remote malicious users to steal cookies via a matching suffix in the domain of a URL.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx curl 7.28.1
haxx curl 7.23.0
haxx curl 7.22.0
haxx curl 7.21.0
haxx curl 7.20.1
haxx curl 7.19.2
haxx curl 7.19.1
haxx curl 7.17.0
haxx curl 7.16.4
haxx curl 7.15.2
haxx curl 7.26.0
haxx curl 7.25.0
haxx curl 7.21.5
haxx curl 7.21.4
haxx curl 7.21.3
haxx curl 7.19.6
haxx curl 7.19.5
haxx curl 7.18.1
haxx curl 7.18.0
haxx curl 7.16.0
haxx curl 7.15.5
haxx curl 7.14.0
haxx curl 7.13.2
haxx curl 7.11.2
haxx curl 7.11.1
haxx curl 7.10.2
haxx curl 7.10.1
haxx curl 7.9.3
haxx curl 7.9.2
haxx curl 7.7.1
haxx curl 7.7
haxx curl 7.3
haxx curl 7.2.1
haxx curl 6.4
haxx curl 6.3.1
haxx curl 7.15.1
haxx curl 7.12.3
haxx curl 7.12.2
haxx curl 7.10.7
haxx curl 7.10.6
haxx curl 7.9.7
haxx curl 7.9.6
haxx curl 7.9
haxx curl 7.8
haxx curl 7.5.2
haxx curl 7.5.1
haxx curl 7.4.2
haxx curl 7.1
haxx curl 6.5.2
haxx curl 6.1
haxx curl 7.28.0
haxx curl 7.27.0
haxx curl 7.21.7
haxx curl 7.21.6
haxx curl 7.20.0
haxx curl 7.19.7
haxx curl 7.19.0
haxx curl 7.18.2
haxx curl 7.16.3
haxx curl 7.16.2
haxx curl 7.16.1
haxx curl 7.15.0
haxx curl 7.14.1
haxx curl 7.12.1
haxx curl 7.12.0
haxx curl 7.10.5
haxx curl 7.10.4
haxx curl 7.10.3
haxx curl 7.9.5
haxx curl 7.9.4
haxx curl 7.7.3
haxx curl 7.7.2
haxx curl 7.4.1
haxx curl 7.4
haxx curl 6.5.1
haxx curl 6.5
haxx curl 6.0
haxx curl 7.24.0
haxx curl 7.23.1
haxx curl 7.21.2
haxx curl 7.21.1
haxx curl 7.19.4
haxx curl 7.19.3
haxx curl
haxx curl 7.17.1
haxx curl 7.15.4
haxx curl 7.15.3
haxx curl 7.13.1
haxx curl 7.13.0
haxx curl 7.11.0
haxx curl 7.10.8
haxx curl 7.10
haxx curl 7.9.8
haxx curl 7.9.1
haxx curl 7.8.1
haxx curl 7.6.1
haxx curl 7.6
haxx curl 7.2
haxx curl 7.1.1
haxx curl 6.3
haxx curl 6.2
haxx libcurl 7.14.0
haxx libcurl 7.14.1
haxx libcurl 7.16.2
haxx libcurl 7.16.3
haxx libcurl 7.28.1
haxx libcurl 7.18.2
haxx libcurl 7.15.3
haxx libcurl 7.15.4
haxx libcurl 7.17.1
haxx libcurl 7.18.0
haxx libcurl 7.21.2
haxx libcurl 7.23.0
haxx libcurl 7.15.5
haxx libcurl 7.16.0
haxx libcurl 7.19.3
haxx libcurl
haxx libcurl 7.22.0
haxx libcurl 7.15.0
haxx libcurl 7.15.1
haxx libcurl 7.15.2
haxx libcurl 7.16.4
haxx libcurl 7.17.0
haxx libcurl 7.28.0
haxx libcurl 7.20.0
canonical ubuntu linux 12.10
canonical ubuntu linux 12.04
canonical ubuntu linux 11.10
canonical ubuntu linux 10.04
canonical ubuntu linux 8.04

Synopsis Moderate: curl security update Type/Severity Security Advisory: Moderate Topic Updated curl packages that fix one security issue are now available forRed Hat Enterprise Linux 5 and 6The Red Hat Security Response Team has rated this update as having moderatesecurity impact A Common Vulnerability S ...

Debian Bug report logs - #705274 curl: CVE-2013-1944: libcurl cookie domain tailmatch Package: curl; Maintainer for curl is Alessandro Ghedini <ghedo@debianorg>; Source for curl is src:curl (PTS, buildd, popcon) Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 12 Apr 2013 11:33:02 UTC Severity: grav ...

Applications using libcurl could be made to expose sensitive information over the network ...

Yamada Yasuharu discovered that cURL, an URL transfer library, is vulnerable to expose potentially sensitive information when doing requests across domains with matching tails Due to a bug in the tailmatch function when matching domain names, it was possible that cookies set for a domain amplecom could accidentally also be sent by libcurl when co ...

The tailMatch function in cookiec in cURL and libcurl before 7300 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL ...

CWE-200 http://www.ubuntu.com/usn/USN-1801-1 http://www.osvdb.org/92316 https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0121 http://secunia.com/advisories/53097 https://github.com/bagder/curl/commit/2eb8dcf26cb37f09cffe26909a646e702dbcab66 http://www.mandriva.com/security/advisories?name=MDVSA-2013:151 http://secunia.com/advisories/53044 http://rhn.redhat.com/errata/RHSA-2013-0771.html http://secunia.com/advisories/53051 https://bugzilla.redhat.com/show_bug.cgi?id=950577 http://www.securityfocus.com/bid/59058 http://curl.haxx.se/docs/adv_20130412.html http://www.debian.org/security/2012/dsa-2660 http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102056.html http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102711.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00013.html http://lists.opensuse.org/opensuse-updates/2013-06/msg00016.html http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105539.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106606.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104598.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104207.html http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html https://access.redhat.com/errata/RHSA-2013:0771 https://usn.ubuntu.com/1801-1/https://nvd.nist.gov https://access.redhat.com/security/cve/cve-2013-1944

Get Started

CVE-2013-1944

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect