The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.

The remote host is affected by the vulnerability described in GLSA-200912-02 (Ruby on Rails: Multiple vulnerabilities)

    The following vulnerabilities were discovered:
    sameer     reported that lib/action_controller/cgi_process.rb removes the     :cookie_only attribute from the default session options     (CVE-2007-6077), due to an incomplete fix for CVE-2007-5380 (GLSA     200711-17).
    Tobias Schlottke reported that the :limit and     :offset parameters of ActiveRecord::Base.find() are not properly     sanitized before being processed (CVE-2008-4094).
    Steve from     Coderrr reported that the CRSF protection in protect_from_forgery()     does not parse the text/plain MIME format (CVE-2008-7248).
    Nate reported a documentation error that leads to the assumption     that a block returning nil passed to     authenticate_or_request_with_http_digest() would deny access to the     requested resource (CVE-2009-2422).
    Brian Mastenbrook reported     an input sanitation flaw, related to multibyte characters     (CVE-2009-3009).
    Gabe da Silveira reported an input sanitation     flaw in the strip_tags() function (CVE-2009-4214).
    Coda Hale     reported an information disclosure vulnerability related to HMAC     digests (CVE-2009-3086).
  Impact :

    A remote attacker could send specially crafted requests to a vulnerable     application, possibly leading to the execution of arbitrary SQL     statements or a circumvention of access control. A remote attacker     could also conduct session fixation attacks to hijack a user's session     or bypass the CSRF protection mechanism, or furthermore conduct     Cross-Site Scripting attacks or forge a digest via multiple attempts.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

Rails core team reports :

The rails core team has released ruby on rails 1.2.6 to address a bug in the fix for session fixation attacks (CVE-2007-5380). The CVE Identifier for this new issue is CVE-2007-6077.

The web server on the remote host appears to be a version of Ruby on Rails that supports URL-based sessions.  An unauthenticated, remote attacker may be able to leverage this issue to obtain an authenticated session. 

Note that Ruby on Rails version 1.2.4 was initially supposed to address this issue, but its session fixation logic only works for the first request, when CgiRequest is first instantiated.

The remote server is running the Ruby on Rails web application.
This version of Rails is reported to be vulnerable to a flaw in the way that it handles authentication data.  Allegedly, the 'lib/action_controller/cgi_process.rb' script is vulnerable to a flaw that would allow an attacker to steal cookie data.  An attacker could then use this data to gain access to the application with the user's credentials.

ID	Name	Product	Family	Severity
43378	GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	critical
28348	FreeBSD : rubygem-rails -- session-fixation vulnerability (30acb8ae-9d46-11dc-9114-001c2514716c)	Nessus	FreeBSD Local Security Checks	medium
28333	Ruby on Rails Multiple Method Session Fixation	Nessus	Web Servers	medium
4299	Ruby on Rails < 1.2.6 Cookie Related Session Fixation	Nessus Network Monitor	Web Servers	medium

Detections

Analytics

CVE-2007-6077

medium

Tenable Plugins

high

critical

medium

medium

medium