CVE-2014-3613: Medium severity curl vulnerability
cURL and libcurl before 7.38.0 does not properly handle IP addresses in cookie domain names, which allows remote attackers to set cookies for or send arbitrary cookies to certain sites, as demonstrated by a site at 192.168.0.1 setting cookies for a site at 127.168.0.1.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3613?
CVE-2014-3613 has a medium severity rating due to its potential to allow cookie manipulation by remote attackers.
How do I fix CVE-2014-3613?
To fix CVE-2014-3613, upgrade to cURL and libcurl version 7.38.0 or later.
Which versions are affected by CVE-2014-3613?
CVE-2014-3613 affects cURL and libcurl versions prior to 7.38.0, including 7.31.0 through 7.37.1.
What types of attacks are possible with CVE-2014-3613?
CVE-2014-3613 can be exploited to send arbitrary cookies to vulnerable sites, potentially leading to session hijacking.
Is CVE-2014-3613 specific to certain operating systems?
No, CVE-2014-3613 affects all operating systems that run affected versions of cURL and libcurl.