Rack arbitrary code execution via timing attack
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2013-0263US | medium5.1OT elevated | — | ||
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session c… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2013-0686.htmlWEB
- http://www.debian.org/security/2013/dsa-2783WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=909071WEB
- https://gist.github.com/codahale/f9f3781f7b54985bee94WEB
- https://github.com/rack/rackWEB
- https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07WEB
- https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan