Debian DSA-537-1 : ruby - insecure file permissions

low Nessus Plugin ID 15374

Synopsis

The remote Debian host is missing a security-related update.

Description

Andres Salomon noticed a problem in the CGI session management of Ruby, an object-oriented scripting language. CGI::Session's FileStore (and presumably PStore, but not in Debian woody) implementations store session information insecurely. They simply create files, ignoring permission issues. This can lead an attacker who has also shell access to the webserver to take over a session.

Solution

Upgrade the libruby package.

For the stable distribution (woody) this problem has been fixed in version 1.6.7-3woody3.

For the unstable and testing distributions (sid and sarge) this problem has been fixed in version 1.8.1+1.8.2pre1-4.

Plugin Details

Severity: Low

ID: 15374

File Name: debian_DSA-537.nasl

Version: 1.23

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 9/29/2004

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 2.7

CVSS v2

Risk Factor: Low

Base Score: 2.1

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:ruby, cpe:/o:debian:debian_linux:3.0

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 8/16/2004

Vulnerability Publication Date: 8/16/2004

Reference Information

CVE: CVE-2004-0755

DSA: 537

Detections

Analytics