CURL/libcURL Cookies handle Remote Security Bypass Vulnerability (CVE-2014-3620)

CURL/libcURL Cookies handle Remote Security Bypass Vulnerability (CVE-2014-3620)

Release date:
Updated on:

Affected Systems:
CURL 7.31.0-7.37.1
Description:
Bugtraq id: 69742
CVE (CAN) ID: CVE-2014-3620

CURL/libcURL is a command line FILE transmission tool that supports FTP, FTPS, HTTP, HTTPS, GOPHER, TELNET, DICT, FILE, and LDAP.

CURL/libcURL 7.31.0-7.37.1 mistakenly sets cookies for TLD. The Remote Security Restriction Bypass Vulnerability exists. Attackers can exploit this vulnerability to bypass the security restriction and perform unauthorized operations.

<* Source: Tim Ruehsen
*>

Suggestion:
Vendor patch:

CURL
----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://curl.haxx.se/

Patch: http://curl.haxx.se/CVE-2014-3620.patch

Reference: http://curl.haxx.se/docs/adv_20140910B.html

Ubuntu users install the download tool cURL 7.36.0

Sharing of Curl usage and common functions in Unix

This article permanently updates the link address: