Ubuntu 12.10: 1801-1 Moderate Risk for Curl Cookie Leakage Issue

ubuntu

April 16, 2013

Applications using libcurl could be made to expose sensitive informationover the network.

Summary

Applications using libcurl could be made to expose sensitive information

over the network.

Software Description:

- curl: HTTP, HTTPS, and FTP client and client libraries

Details:

YAMADA Yasuharu discovered that libcurl was vulnerable to a cookie

leak when doing requests across domains with matching tails. curl did

not properly restrict cookies to domains and subdomains. If a user or

automated system were tricked into processing a specially crafted URL,

an attacker could read cookie values stored by unrelated webservers.

Topics Covered

security advisory moderate information leak Ubuntu curl network exposure

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  curl                            7.27.0-1ubuntu1.2
  libcurl3                        7.27.0-1ubuntu1.2

Ubuntu 12.04 LTS:
  curl                            7.22.0-3ubuntu4.1
  libcurl3                        7.22.0-3ubuntu4.1

Ubuntu 11.10:
  curl                            7.21.6-3ubuntu3.3
  libcurl3                        7.21.6-3ubuntu3.3

Ubuntu 10.04 LTS:
  curl                            7.19.7-1ubuntu1.2
  libcurl3                        7.19.7-1ubuntu1.2

Ubuntu 8.04 LTS:
  curl                            7.18.0-1ubuntu2.4
  libcurl3                        7.18.0-1ubuntu2.4

In general, a standard system update will make all the necessary changes.