PT-2007-6979 · Ruby · Ruby On Rails

Publicado 2007-11-21 · Atualizado 2019-08-08 · CVE-2007-6077

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ruby on Rails version 1.2.4

Description The session fixation protection mechanism in Ruby on Rails has an issue that allows remote attackers to conduct session fixation attacks. This is due to an incomplete fix for a previous issue, which causes the :cookie only attribute to be applied only to the first instantiation of CgiRequest.

Recommendations For Ruby on Rails version 1.2.4, consider applying a complete fix to the session fixation protection mechanism to prevent remote attackers from conducting session fixation attacks. As a temporary workaround, consider restricting access to sensitive areas of the application that rely on session fixation protection until a complete fix is applied.

Exploit

Correção

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

CVE-2007-6077

GHSA-P4C6-77GC-694X

Produtos afetados

Ruby On Rails

Referências · 20

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-6077.yml · Exploit
• http://dev.rubyonrails.org/ticket/10048 · Correção
• https://security-tracker.debian.org/tracker/CVE-2007-6077 · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-6077 · Nota de Segurança
• http://secunia.com/advisories/28136 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-p4c6-77gc-694x · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/4238 · Aviso do Fabricante
• http://docs.info.apple.com/article.html?artnum=307179 · Nota
• http://us-cert.gov/cas/techalerts/TA07-352A.html · Nota
• http://vupen.com/english/advisories/2007/4009 · Aviso do Fabricante
• https://github.com/advisories/GHSA-p4c6-77gc-694x · Nota
• http://secunia.com/advisories/27781 · Aviso do Fabricante
• http://weblog.rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6077 · Aviso do Fabricante