PT-2007-6979 · Ruby · Ruby On Rails

Published 2007-11-21 · Updated 2019-08-08 · CVE-2007-6077

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ruby on Rails version 1.2.4

Description The session fixation protection mechanism in Ruby on Rails has an issue that allows remote attackers to conduct session fixation attacks. This is due to an incomplete fix for a previous issue, which causes the :cookie only attribute to be applied only to the first instantiation of CgiRequest.

Recommendations For Ruby on Rails version 1.2.4, consider applying a complete fix to the session fixation protection mechanism to prevent remote attackers from conducting session fixation attacks. As a temporary workaround, consider restricting access to sensitive areas of the application that rely on session fixation protection until a complete fix is applied.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2007-6077

GHSA-P4C6-77GC-694X

Affected Products

Ruby On Rails

References · 20

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-6077.yml · Exploit
• http://dev.rubyonrails.org/ticket/10048 · Patch
• https://security-tracker.debian.org/tracker/CVE-2007-6077 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-6077 · Security Note
• http://secunia.com/advisories/28136 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p4c6-77gc-694x · Vendor Advisory
• http://vupen.com/english/advisories/2007/4238 · Vendor Advisory
• http://vupen.com/english/advisories/2007/4009 · Vendor Advisory
• http://secunia.com/advisories/27781 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2007-6077 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-6077 · Vendor Advisory
• http://docs.info.apple.com/article.html?artnum=307179 · Note
• http://us-cert.gov/cas/techalerts/TA07-352A.html · Note
• https://github.com/advisories/GHSA-p4c6-77gc-694x · Note