libcurl was updated to fix a cookie tail matching flaw which could lead to attackers gaining cookie access depending on domain names.
(CVE-2013-1944,bnc#814655)

The remote host is affected by the vulnerability described in GLSA-201401-14 (cURL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in cURL. Please review the       CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user or automated process to connect to       a malicious server using cURL, possibly resulting in the remote execution       of arbitrary code or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

fix cookie tailmatching to prevent cross-domain leakage (CVE-2013-1944)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- prevent an artificial timeout event due to stale     speed-check data (#906031)

    - show proper host name on failed resolve (#957173) fix       cookie tailmatching to prevent cross-domain leakage       (CVE-2013-1944)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes the cookie domain tailmatch vulnerability in curl.
CVE-2013-1944 has been assigned to this issue. Also the CA-Cert Bundle has been updated to the current state.

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. (CVE-2013-1944)

This update of compat-curl2 fixes several security issues.

  - fixes for the cookie domain tailmatch vulnerability.
    (bnc#814655)

  - updated curl CA-Cert Bundle. (bnc#810010)

  - fixes for a potential BEAST attack (bnc#742306)

The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL.

switch SSL socket into non-blocking mode after handshake (#960765)

  - prevent an artificial timeout event due to stale     speed-check data (#906031)

    - show proper host name on failed resolve (#957173) fix       cookie tailmatching to prevent cross-domain leakage       (CVE-2013-1944)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
74978	openSUSE Security Update : curl (openSUSE-SU-2013:0876-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
72053	GLSA-201401-14 : cURL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2014/1/21	2021/1/6	high
66009	Fedora 18 : curl-7.27.0-8.fc18 (2013-5618)	Nessus	Fedora Local Security Checks	2013/4/18	2021/1/11	medium
66284	Fedora 19 : curl-7.29.0-6.fc19 (2013-6780)	Nessus	Fedora Local Security Checks	2013/5/1	2021/1/11	medium
66356	SuSE 10 Security Update : curl, curl (ZYPP Patch Number 8550)	Nessus	SuSE Local Security Checks	2013/5/9	2021/1/19	medium
79602	F5 Networks BIG-IP : cURL vulnerability (SOL15875)	Nessus	F5 Networks Local Security Checks	2014/11/28	2021/3/10	medium
66355	SuSE 10 Security Update : compat-curl2 (ZYPP Patch Number 8557)	Nessus	SuSE Local Security Checks	2013/5/9	2021/1/19	medium
69768	Amazon Linux AMI : curl (ALAS-2013-210)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	medium
66594	Fedora 17 : curl-7.24.0-9.fc17 (2013-7797)	Nessus	Fedora Local Security Checks	2013/5/26	2021/1/11	medium

检测

插件搜索

medium

high

medium

medium

medium

medium

medium

medium

medium