CVE-2013-4136

EPSS 0.04%

insecure temporary directory usage in passenger

發布日:2017/10/24修改日:2026/4/28

也稱為:GHSA-w6rc-q387-vpgqDEBIAN-CVE-2013-4136

描述

ext/common/ServerInstanceDir.h in Phusion Passenger gem before 4.0.6 for Ruby allows local users to gain privileges or possibly change the ownership of arbitrary directories via a symlink attack on a directory with a predictable name in /tmp/.

受影響套件(2)

Debian/passengerfrom 0, < 3.0.13debian-1.2
RubyGems/passengerfrom 0, < 4.0.6

參考連結(10)

ADVISORYhttps://github.com/advisories/GHSA-w6rc-q387-vpgq
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2013-4136
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2013-4136
PATCHhttps://github.com/phusion/passenger
WEBhttp://rhn.redhat.com/errata/RHSA-2013-1136.html
WEBhttps://code.google.com/p/phusion-passenger/issues/detail?id=910
WEBhttps://github.com/phusion/passenger/blob/release-4.0.6/NEWS
WEBhttps://github.com/phusion/passenger/commit/5483b3292cc2af1c83033eaaadec20dba4dcfd9b
WEBhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/passenger/CVE-2013-4136.yml
WEBhttp://www.openwall.com/lists/oss-security/2013/07/16/6