Explain CVE-2013-1944
The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html'}, {'name': 'MDVSA-2013:151', 'tags': ['vendor-advisory', 'x_refsource_MANDRIVA'], 'url': 'http://www.mandriva.com/security/advisories?name=MDVSA-2013:151'}, {'name': '92316', 'tags': ['vdb-entry', 'x_refsource_OSVDB'], 'url': 'http://www.osvdb.org/92316'}, {'name': 'DSA-2660', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'http://www.debian.org/security/2012/dsa-2660'}, {'name': 'FEDORA-2013-6766', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104598.html'}, {'name': 'USN-1801-1', 'tags': ['vendor-advisory', 'x_refsource_UBUNTU'], 'url': 'http://www.ubuntu.com/usn/USN-1801-1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=950577'}, {'name': 'FEDORA-2013-6780', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104207.html'}, {'name': 'FEDORA-2013-5618', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102056.html'}, {'name': 'FEDORA-2013-5598', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102711.html'}, {'name': 'APPLE-SA-2013-10-22-3', 'tags': ['vendor-advisory', 'x_refsource_APPLE'], 'url': 'http://lists.apple.com/archives/security-announce/2013/Oct/msg00004.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'http://curl.haxx.se/docs/adv_20130412.html'}, {'name': 'openSUSE-SU-2013:0879', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00016.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wiki.mageia.org/en/Support/Advisories/MGASA-2013-0121'}, {'name': '59058', 'tags': ['vdb-entry', 'x_refsource_BID'], 'url': 'http://www.securityfocus.com/bid/59058'}, {'name': '53044', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53044'}, {'name': 'RHSA-2013:0771', 'tags': ['vendor-advisory', 'x_refsource_REDHAT'], 'url': 'http://rhn.redhat.com/errata/RHSA-2013-0771.html'}, {'name': '53051', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53051'}, {'name': 'FEDORA-2013-7813', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105539.html'}, {'name': 'FEDORA-2013-7797', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106606.html'}, {'name': '53097', 'tags': ['third-party-advisory', 'x_refsource_SECUNIA'], 'url': 'http://secunia.com/advisories/53097'}, {'name': 'openSUSE-SU-2013:0876', 'tags': ['vendor-advisory', 'x_refsource_SUSE'], 'url': 'http://lists.opensuse.org/opensuse-updates/2013-06/msg00013.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://github.com/bagder/curl/commit/2eb8dcf26cb37f09cffe26909a646e702dbcab66'}]
CVE State: PUBLISHED