Veracode Vulnerability DatabaseVERACODE:11709Cookie Leak
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
libcurl.so is vulnerable to cookie leak. A remote attacker is able to set or send arbitrary cookies for certain sites. libcurl.so parses IP addresses similar to domain names, where a site with an IP address of 192.168.0.1 can set or send cookies for another site ending with .168.0.1.
References
curl.haxx.se/docs/adv_20140910A.html
kb.juniper.net/InfoCenter/index?page=content&id=JSA10743
lists.apple.com/archives/security-announce/2015/Aug/msg00001.html
lists.opensuse.org/opensuse-security-announce/2014-09/msg00024.html
rhn.redhat.com/errata/RHSA-2015-1254.html
www.debian.org/security/2014/dsa-3022
www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
www.securityfocus.com/bid/69748
access.redhat.com/security/updates/classification/#moderate
bugzilla.redhat.com/show_bug.cgi?id=1008178
bugzilla.redhat.com/show_bug.cgi?id=1011083
bugzilla.redhat.com/show_bug.cgi?id=1011101
bugzilla.redhat.com/show_bug.cgi?id=1058767
bugzilla.redhat.com/show_bug.cgi?id=1104160
bugzilla.redhat.com/show_bug.cgi?id=1154059
bugzilla.redhat.com/show_bug.cgi?id=1154747
bugzilla.redhat.com/show_bug.cgi?id=1156422
bugzilla.redhat.com/show_bug.cgi?id=1161163
bugzilla.redhat.com/show_bug.cgi?id=1168137
bugzilla.redhat.com/show_bug.cgi?id=835898
bugzilla.redhat.com/show_bug.cgi?id=883002
bugzilla.redhat.com/show_bug.cgi?id=997185
rhn.redhat.com/errata/RHSA-2015-1254.html
support.apple.com/kb/HT205031
Related
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N