CVE-2013-4136

描述

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

如何修補 CVE-2013-4136

要修補 CVE-2013-4136,請將受影響套件升級到下列已修補版本。

• Debian/passenger—升級至 3.0.13debian-1.2 或更新版本
• RubyGems/passenger—升級至 4.0.6 或更新版本

CVE-2013-4136 正在被利用嗎?

低 — EPSS 為 0.3%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 3.0.13debian-1.2
• from 0, < 4.0.6

參考連結(10)

• ADVISORYgithub.com/advisories/GHSA-w6rc-q387-vpgq
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-4136
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2013-4136
• PATCHgithub.com/phusion/passenger
• WEB