CVE

Id
29434  
CVE No.
CVE-2007-6077  
Status
Candidate  
Description
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.  
Phase
Assigned (20071121)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
309520 29434 CVE-2007-6077 CONFIRM:http://dev.rubyonrails.org/changeset/8177  View
309521 29434 CVE-2007-6077 CONFIRM:http://dev.rubyonrails.org/ticket/10048  View
309522 29434 CVE-2007-6077 CONFIRM:http://weblog.rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release  View
309523 29434 CVE-2007-6077 CONFIRM:http://docs.info.apple.com/article.html?artnum=307179  View
309524 29434 CVE-2007-6077 APPLE:APPLE-SA-2007-12-17  View
309525 29434 CVE-2007-6077 URL:http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html  View
309526 29434 CVE-2007-6077 CERT:TA07-352A  View
309527 29434 CVE-2007-6077 URL:http://www.us-cert.gov/cas/techalerts/TA07-352A.html  View
309528 29434 CVE-2007-6077 BID:26598  View
309529 29434 CVE-2007-6077 URL:http://www.securityfocus.com/bid/26598  View
309530 29434 CVE-2007-6077 VUPEN:ADV-2007-4009  View
309531 29434 CVE-2007-6077 URL:http://www.vupen.com/english/advisories/2007/4009  View
309532 29434 CVE-2007-6077 VUPEN:ADV-2007-4238  View
309533 29434 CVE-2007-6077 URL:http://www.vupen.com/english/advisories/2007/4238  View
309534 29434 CVE-2007-6077 SECUNIA:27781  View
309535 29434 CVE-2007-6077 URL:http://secunia.com/advisories/27781  View
309536 29434 CVE-2007-6077 SECUNIA:28136  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
54225 JVNDB-2007-002917 bcoos の include/common.php におけるディレクトリトラバーサルの脆弱性 bcoos の include/common.php には、ディレクトリトラバーサルの脆弱性が存在します。 CVE-2007-6079 29434 6.8 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-002917.html  View