CVE-2013-1944: Infoleak
A security flaw was found in the way the library of cURL, an utility for retrieval of files from remote servers, performed match of cookie domain names when making a decision if (previously stored cookies) should be sent to particular domain. Due to a bug in match function implementation, (formerly) the decision / match succeeded also in cases, where just suffix / certain part of the domain name matched the domain name, the current request originated from. A remote attacker could use this flaw to possibly hijack the user session of the victim by submitting a request containing a specially-crafted domain name.
References: [1] http://thread.gmane.org/gmane.comp.web.curl.library/38986
Acknowledgements:
Red Hat would like to thank the cURL project for reporting this issue. Upstream acknowledges YAMADA Yasuharu as the original reporter.
Other sources
The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1944?
The severity of CVE-2013-1944 is rated as moderate due to potential unauthorized cookie access.
How do I fix CVE-2013-1944?
To fix CVE-2013-1944, upgrade to a version of cURL greater than 7.30.0.
What can be exploited through CVE-2013-1944?
CVE-2013-1944 can be exploited to send cookies to incorrect domains, leading to potential security vulnerabilities.
Which versions are affected by CVE-2013-1944?
CVE-2013-1944 affects cURL versions up to 7.30.0, including numerous prior versions.
Is CVE-2013-1944 present in libcurl as well?
Yes, CVE-2013-1944 also affects libcurl versions up to 7.29.0.