[CVE-2007-6077] Potential session fixation attack

[William Grant]

Binary package hint: rails

The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.

Hardy has 1.2.6, so should be fixed.

[Kees Cook (kees)]

Thanks for preparing this! I've uploaded it to the security queue; it should be published shortly.

[William Grant (wgrant)]

rails (1.2.4-1ubuntu1.1) gutsy-security; urgency=low

  * SECURITY UPDATE: Session fixation attack via broken :cookie_only
    attribute. (LP: #173203)
  * debian/patches/20_CVE-2007-6077: Fix broken session fixation catching.
    Patch from upstream bug.
  * References
    CVE-2007-6077

 -- William Grant <email address hidden> Sat, 01 Dec 2007 20:09:54 +1100

[Hew (hew)]

Ubuntu Edgy Eft is no longer supported, so a SRU will not be issued for this release. Marking Edgy as Won't Fix.

[LumpyCustard (orangelumpycustard)]

Please close for Feisty as Won't Fix? This goes for all the other Feisty bugs.

[Hew (hew)]

Ubuntu Feisty Fawn is no longer supported, so a SRU will not be issued for this release. Marking Feisty as Won't Fix.

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. dapper has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against dapper is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.