Bug 130063

Summary:	CAN-2004-0755 ruby insecure file permissions
Product:	[Fedora] Fedora	Reporter:	Josh Bressers <bressers>
Component:	ruby	Assignee:	Akira TAGOH <tagoh>
Status:	CLOSED ERRATA	QA Contact:	Bill Huang <bhuang>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	2	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	1.8.1-6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2004-10-15 08:56:01 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2004-08-16 20:17:19 UTC

From the Debian DSA

Andres Salomon no ticed a problem in the CGI session management of
Ruby, an object-oriented scripting language.  CGI::Session's FileStore
(and presumably PStore, but not in Debian woody) implementations store
session information insecurely.  They simply create files, ignoring
permission issues.  This can lead an attacker who has also shell
access to the webserver to take over a session.

This issue was reported to the Debian bug system
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=260779

This issue should also affect FC1

Comment 1 Akira TAGOH 2004-08-18 10:44:04 UTC

this problem should be fixed in 1.8.1-6.