CVE-2013-0263

Description (CNA)

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.

Affected (CNA)

CWE

No CWE identifiers supplied.

References

• http://secunia.com/advisories/52774
• https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ
• https://groups.google.com/forum/#%21msg/rack-devel/RnQxm6i13C4/xfakH81yWvgJ
• https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11
• http://secunia.com/advisories/52033
• https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07
• http://rack.github.com/
• http://secunia.com/advisories/52134
• https://groups.google.com/d/msg/rack-devel/xKrHVWeNvDM/4ZGA576CnK4J
• https://bugzilla.redhat.com/show_bug.cgi?id=909071
• https://groups.google.com/forum/#%21msg/rack-devel/hz-liLb9fKE/8jvVWU6xYiYJ
• https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ
• http://rhn.redhat.com/errata/RHSA-2013-0686.html
• http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
• https://puppet.com/security/cve/cve-2013-0263
• https://gist.github.com/codahale/f9f3781f7b54985bee94
• https://twitter.com/coda/statuses/299732877745197056
• http://www.osvdb.org/89939
• http://www.debian.org/security/2013/dsa-2783

ADP enrichment