CVE - CVE-2013-0263

CVE-ID
CVE-2013-0263	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:52033 URL:http://secunia.com/advisories/52033 MISC:52134 URL:http://secunia.com/advisories/52134 MISC:52774 URL:http://secunia.com/advisories/52774 MISC:89939 URL:~~http://www.osvdb.org/89939~~ (Obsolete source) MISC:DSA-2783 URL:http://www.debian.org/security/2013/dsa-2783 MISC:RHSA-2013:0686 URL:http://rhn.redhat.com/errata/RHSA-2013-0686.html MISC:http://rack.github.com/ URL:http://rack.github.com/ MISC:https://bugzilla.redhat.com/show_bug.cgi?id=909071 URL:https://bugzilla.redhat.com/show_bug.cgi?id=909071 MISC:https://gist.github.com/codahale/f9f3781f7b54985bee94 URL:https://gist.github.com/codahale/f9f3781f7b54985bee94 MISC:https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07 URL:https://github.com/rack/rack/commit/0cd7e9aa397f8ebb3b8481d67dbac8b4863a7f07 MISC:https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11 URL:https://github.com/rack/rack/commit/9a81b961457805f6d1a5c275d053068440421e11 MISC:https://groups.google.com/d/msg/rack-devel/xKrHVWeNvDM/4ZGA576CnK4J URL:https://groups.google.com/d/msg/rack-devel/xKrHVWeNvDM/4ZGA576CnK4J MISC:https://groups.google.com/forum/#%21msg/rack-devel/RnQxm6i13C4/xfakH81yWvgJ URL:https://groups.google.com/forum/#%21msg/rack-devel/RnQxm6i13C4/xfakH81yWvgJ MISC:https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ URL:https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ MISC:https://groups.google.com/forum/#%21msg/rack-devel/hz-liLb9fKE/8jvVWU6xYiYJ URL:https://groups.google.com/forum/#%21msg/rack-devel/hz-liLb9fKE/8jvVWU6xYiYJ MISC:https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ URL:https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ MISC:https://puppet.com/security/cve/cve-2013-0263 URL:https://puppet.com/security/cve/cve-2013-0263 MISC:https://twitter.com/coda/statuses/299732877745197056 URL:https://twitter.com/coda/statuses/299732877745197056 MISC:openSUSE-SU-2013:0462 URL:http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
Assigning CNA
Red Hat, Inc.
Date Record Created
20121206	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20121206)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)

Use of the CVE® List and the associated references from this website are subject to the terms of use. CVE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). Copyright © 1999–2024, The MITRE Corporation. CVE and the CVE logo are registered trademarks of The MITRE Corporation.