CGI::Session driver files insecure permissions
| cgisession-driver-files-insecure-permissions (25283) |  Low Risk |
Description:
CGI::Session versions 4.03 and prior could disclose sensitive information. The Driver::file, Driver::db_file, and Driver::sqlite create session files insecurely in the /tmp directory. A local attacker could exploit this vulnerability to obtain sensitive information.
Consequences:
Obtain Information
Remedy:
For Debian GNU/Linux:
Apply the patch for this vulnerability, as listed in Debian Bug report logs - #356555. See References.
For other distributions:
Contact your vendor for patch or upgrade information.
References:
- Debian Bug report logs - #356555: writes session files insecurely to /tmp; symlink attacks and data exposure.
- search.cpan.org: CGI::Session - persistent session data in CGI applications - search.cpan.org.
- BID-17099: CGI::Session Multiple Information Disclosure Vulnerabilities
- BID-17177: Libcgi-session-perl Multiple Insecure Temporary File Creation Vulnerabilities
- CVE-2006-1280: CGI::Session 4.03-1 does not set proper permissions on temporary files created in (1) Driver::File and (2) Driver::db_file, which allows local users to obtain privileged information, such as session keys, by viewing the files.
- OSVDB ID: 23866: CGI::Session Session File Permission Weakness Local Information Disclosure
- OSVDB ID: 23867: CGI::Session Driver::db_file cgisess.db Remote Disclosure
- SA19211: CGI::Session Insecure Default Session File Permissions
- VUPEN/ADV-2006-0946: CGI::Session Multiple Insecure Session File Permissions Vulnerabilities
Platforms Affected:
- CGI::Session Project CGI::Session 4.03 and prior
Reported:
Mar 13, 2006
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net