CVE-2013-4136: Medium severity phusion passenger vulnerability
Published Sep 30, 2013
·Updated
ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.
Affected Software
6 affected components
Phusion Passenger<=4.0.5
Phusion Passenger=4.0.1
Phusion Passenger=4.0.2
Phusion Passenger=4.0.3
Phusion Passenger=4.0.4
ruby-lang Ruby
Event History
Sep 30, 2013
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2013-4136?
CVE-2013-4136 has a medium severity level due to its potential for local privilege escalation via symlink attacks.
2
How do I fix CVE-2013-4136?
To fix CVE-2013-4136, upgrade Phusion Passenger to version 4.0.6 or later.
3
Who is affected by CVE-2013-4136?
CVE-2013-4136 affects users of Phusion Passenger versions before 4.0.6.
4
What is the impact of CVE-2013-4136?
The impact of CVE-2013-4136 includes the potential for local users to gain elevated privileges and change ownership of arbitrary directories.
5
Is CVE-2013-4136 exploitable on all systems?
CVE-2013-4136 is exploitable on systems where Phusion Passenger is installed and configured insecurely.