CVE-2014-3613

Vulnerability

In cURL and libcurl versions 4.0 through 7.37.1, improper handling of IP addresses in cookie domain names allows an attacker to set or send cookies to arbitrary sites. The issue occurs when a client accesses a site using a numerical IP address, and the site sends cookies with a partial IP address as the domain. libcurl treats the IP address as a domain name, so a site at 192.168.0.1 can set cookies for any ending with .168.0.1, potentially leaking cookies to other IPs like 129.168.0.1 [3].

Exploitation

An attacker needs to control a server accessed via its literal IP address by the victim, and that server must send cookies with a domain attribute containing a partial IP address. No authentication or user interaction beyond normal browsing is required. The vulnerability only applies to IPv4 addresses with dots or IPv6 addresses using dotted-quad notation [3].

Impact

Successful exploitation allows an attacker to force libcurl to send cookies to unintended sites or to set cookies for other sites, leading to information disclosure or session hijacking. The impact is limited to applications that use cookies with libcurl, which is opt-in by default [3].

Mitigation

The vulnerability is fixed in libcurl 7.38.0, released on September 10, 2014 [3]. Users should upgrade to version 7.38.0 or later. Red Hat issued RHSA-2015-1254 for affected RHEL versions [2]. Apple included the fix in OS X Yosemite v10.10.5 and Security Update 2015-006 [1]. No workaround exists except avoiding use of cookies with IP-based URLs.