National Cyber Awareness System

Vulnerability Summary for CVE-2013-0262

Overview

rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka "symlink path traversals."

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: https://groups.google.com/forum/#!msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ

Hyperlink:https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ

External Source: CONFIRM

Name: https://groups.google.com/forum/#!msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ

Hyperlink:https://groups.google.com/forum/#%21msg/rack-devel/bf937jPZxJM/1s6x95vIhmAJ

External Source: CONFIRM

Name: https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30

Hyperlink:https://github.com/rack/rack/commit/6f237e4c9fab649d3750482514f0fde76c56ab30

External Source: MISC

Name: https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56

Hyperlink:https://github.com/rack/rack/blob/master/lib/rack/file.rb#L56

External Source: MISC

Name: https://gist.github.com/rentzsch/4736940

Hyperlink:https://gist.github.com/rentzsch/4736940

External Source: CONFIRM

Name: https://bugzilla.redhat.com/show_bug.cgi?id=909072

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=909072

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=909071

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=909071

External Source: SECUNIA

Name: 52033

Type: Advisory

Hyperlink:http://secunia.com/advisories/52033

External Source: CONFIRM

Name: http://rack.github.com/

Hyperlink:http://rack.github.com/

External Source: SUSE

Name: openSUSE-SU-2013:0462

Hyperlink:http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html