CVE-2013-0263

NameCVE-2013-0263
DescriptionRack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-2783-1
NVD severitymedium (attack range: remote)
Debian Bugs700226
Debian/oldoldstablenot vulnerable.
Debian/oldstablenot vulnerable.
Debian/stablenot vulnerable.
Debian/testingnot vulnerable.
Debian/unstablenot vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
librack-ruby (PTS)squeeze, squeeze (security)1.1.0-4+squeeze2fixed
squeeze (lts)1.1.0-4+squeeze3fixed
ruby-rack (PTS)wheezy1.4.1-2.1fixed
stretch, jessie1.5.2-3fixed
sid1.5.2-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
librack-rubysource(unstable)(unfixed)medium700226
librack-rubysourcesqueeze1.1.0-4+squeeze1mediumDSA-2783-1
ruby-racksource(unstable)1.4.1-2.1medium700226

Notes

https://bugzilla.novell.com/show_bug.cgi?id=802794
Patches in git, commits 0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07 and 9a81b961457805f6d1a5c275d053068440421e11

Search for package or bug name: Reporting problems