JVNDB-2004-000323

Ruby CGI Session Management Insecure File Permission Vulnerability

Ruby uses CGI::Session's FileStore. FileStore creates a session file with improper permission and this could lead to session information leak.

Base Metrics: 2.1 (Low) [NVD Score]

• Access Vector: Local
• Access Complexity: Low
• Authentication: None
• Confidentiality Impact: Partial
• Integrity Impact: None
• Availability Impact: None

Ruby

• Ruby 1.6
• Ruby 1.8

Turbolinux, Inc.

• Turbolinux 10 Desktop
• Turbolinux 10 F...
• Turbolinux 10 Server
• Turbolinux 7 Server
• Turbolinux 7 Workstation
• Turbolinux 8 Server
• Turbolinux 8 Workstation
• Turbolinux Home

Red Hat, Inc.

• Red Hat Desktop (v.3)
• Red Hat Enterprise Linux AS (v.2.1)
• Red Hat Enterprise Linux AS (v.3)
• Red Hat Enterprise Linux ES (v.2.1)
• Red Hat Enterprise Linux ES (v.3)
• Red Hat Enterprise Linux WS (v.2.1)
• Red Hat Enterprise Linux WS (v.3)

An attacker could hijack sessions utilizing stolen information.

Please refer to the 'Vendor Information' section for official remediation and take appropriate action.

Ruby

• Ruby : Top Page

Turbolinux, Inc.

• Turbolinux Security Advisory : TLSA-2005-15

Red Hat, Inc.

• Red Hat Security Advisory : RHSA-2004:441

1. CVE-2004-0755

1. National Vulnerability Database (NVD) : CVE-2004-0755
2. SecurityFocus : 10946
3. ISS X-Force Database : 16996

[2008/05/21]
  Web page published