Bug 917925 (CVE-2012-6135) - CVE-2012-6135 rubygem-passenger: untrusted apps Security check socket filenames reported by spawned application processes
Summary: CVE-2012-6135 rubygem-passenger: untrusted apps Security check socket filenam...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2012-6135
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 917928 917930 917931 917932
Blocks: 917927
TreeView+ depends on / blocked
 
Reported: 2013-03-05 06:52 UTC by Kurt Seifried
Modified: 2021-02-17 07:58 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2014-06-27 19:52:53 UTC
Embargoed:


Attachments (Terms of Use)

Description Kurt Seifried 2013-03-05 06:52:53 UTC
foobarwidget reports:

It fixes a security issue, but unless you're on a shared environment it's not 
a grave issue. It allows an application process to delete an arbitrary file, 
even a file it does not have permission to, but only during application 
startup (i.e. during evaluation of config.ru). Once the application is started,
it cannot be exploited, so external visitors cannot influence this. If you 
deploy arbitrary untrusted apps on your server then this issue can be a 
problem. If all your apps are trusted (e.g. because your organization wrote 
them) then there's no problem.

https://github.com/FooBarWidget/passenger/commit/8c6693e0818772c345c979840d28312c2edd4ba4#commitcomment-2643541

Comment 1 Kurt Seifried 2013-03-05 06:57:50 UTC
Created rubygem-passenger tracking bugs for this issue

Affects: epel-6 [bug 917928]

Comment 2 Kurt Seifried 2013-03-05 06:58:29 UTC
Created rubygem-passenger tracking bugs for this issue

Affects: fedora-all [bug 917930]

Comment 5 Hongli Lai 2013-03-05 11:43:27 UTC
We've released a security advisory here: http://blog.phusion.nl/2013/03/05/phusion-passenger-4-0-beta-1-and-2-arbitrary-file-deletion-vulnerability/

Affected versions:

Phusion Passenger open source 4.0.0 beta 1
Phusion Passenger open source 4.0.0 beta 2
Phusion Passenger Enterprise 4.0.0 beta 1
Phusion Passenger Enterprise 4.0.0 beta 2

Unaffected versions:

Phusion Passenger open source 3.x and earlier
Phusion Passenger open source 4.0.0 RC 1 and later
Phusion Passenger Enterprise 3.x and earlier
Phusion Passenger Enterprise 4.0.0 RC 1 and later

Comment 6 Kurt Seifried 2014-06-27 19:52:53 UTC
Statement:

Not vulnerable. This issue did not affect the versions of rubygem-passenger as shipped with Red Hat OpenShift Enterprise 1.2 do not include the vulnerable code.


Note You need to log in before you can comment on or make changes to this bug.