CVE-2014-3613

What it actually does

cURL and libcurl before 7.38.0 fail to validate IP addresses used as cookie domain names, permitting a site at one IP to set cookies that are later sent to a different IP address.

Why it matters to the business

Attackers can inject cookies into sessions for targeted sites, enabling unauthorized tracking, session manipulation, or bypass of domain-based cookie isolation controls.

How an attack unfolds

An attacker controls a response from a site reachable at an IP address and includes a Set-Cookie header whose domain attribute is another IP; the vulnerable client accepts and stores the cookie, then sends it on future requests to the second IP.

How to fix it

Upgrade cURL and libcurl to version 7.38.0 or newer. For the listed Ubuntu package, apply flashplugin-nonfree updates to 11.2.202.521ubuntu0.14.04.1.

How to confirm the fix worked

Confirm installed libcurl version is at least 7.38.0; test cookie behavior with requests that use IP literals in domain attributes.

Typical attack path

1. Attacker positions a malicious HTTP response containing a cookie with an IP address in the domain field
2. Victim application using vulnerable libcurl processes the response
3. Cookie is stored without proper IP domain validation
4. Subsequent requests to the target IP automatically include the attacker-supplied cookie

How to detect it

Review application logs for HTTP responses or cookie operations involving IP address literals in domain fields; inspect libcurl debug output or traffic captures for unexpected cross-IP cookie transmission.

What your security team should do

• Apply the 7.38.0 libcurl update immediately on all affected systems
• Audit applications and scripts that embed or call libcurl for cookie handling
• Add version checks for libcurl to build and deployment pipelines