CVE-2004-0755: Low severity Yukihiro Matsumoto Ruby vulnerability
Published Aug 19, 2004
·Updated
The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions.
Affected Software
2 affected components
Yukihiro Matsumoto Ruby=1.6
Yukihiro Matsumoto Ruby=1.8
Remediation
Patch Available
Patch Available
Event History
Aug 19, 2004
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-0755?
CVE-2004-0755 is considered a moderate severity vulnerability due to the risk of session hijacking.
2
How do I fix CVE-2004-0755?
To address CVE-2004-0755, upgrade Ruby to version 1.8.1 or later, which ensures secure file permissions.
3
Who is affected by CVE-2004-0755?
CVE-2004-0755 affects users of Ruby versions 1.6 and 1.8 that utilize the CGI::Session FileStore capability.
4
What potential risks are associated with CVE-2004-0755?
The risks of CVE-2004-0755 include the unauthorized access and theft of session information by local users.
5
Is CVE-2004-0755 a coding issue in Ruby?
Yes, CVE-2004-0755 is a coding issue in Ruby related to improper file permission settings for session files.