TITLE:
CGI::Session Insecure Default Session File Permissions

SECUNIA ADVISORY ID:
SA19211

VERIFY ADVISORY:
http://secunia.com/advisories/19211/

CRITICAL:
Less critical

IMPACT:
Exposure of sensitive information

WHERE:
>From remote

SOFTWARE:
CGI::Session 4.x
http://secunia.com/product/8688/

DESCRIPTION:
Joey Hess has reported some security issues in CGI::Session, which
potentially can be exploited by malicious, local users and by
malicious people to disclose certain sensitive information.

1) Session files are created by Driver::file, Driver::db_file, and
Driver::sqlite with insecure default read permissions. This can
potentially be exploited by malicious, local users to gain knowledge
of data stored in session files, e.g. Driver::file stores the session
files in "/tmp" by default.

2) The "cgisess.db" session file is created by Driver::db_file in the
same directory as the CGI script. In certain configurations, this file
may be created in a web accessible directory. This can potentially be
exploited by malicious people to gain knowledge of session data.

The security issues have been reported in version 4.03. Other
versions may also be affected.

SOLUTION:
Edit CGI Perl scripts that use the library to store session files in
directories that are not accessible by other users.

PROVIDED AND/OR DISCOVERED BY:
Joey Hess

ORIGINAL ADVISORY:
Debian:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356555

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------