Vulnerabilty in CGI::Session Reported

A security issue with CGI has been reported on the the security site Secunia.

CGIDir
Wednesday, March 22, 2006; 04:39 AM

A security issue with CGI has been reported on the the security site Secunia.  The vulnerability is classified as "less critical".

The security issue is in CGI::Session, and potentially can be exploited by malicious, local users and by malicious people to disclose certain sensitive information.

1) Session files are created by Driver::file, Driver::db_file, and Driver::sqlite with insecure default read permissions. This can potentially be exploited by malicious, local users to gain knowledge of data stored in session files, e.g. Driver::file stores the session files in "/tmp" by default.

2) The "cgisess.db" session file is created by Driver::db_file in the same directory as the CGI script. In certain configurations, this file may be created in a web accessible directory. This can potentially be exploited by malicious people to gain knowledge of session data.

The security issues have been reported in version 4.03. Other versions may also be affected.

Solution:
Edit CGI Perl scripts that use the library to store session files in directories that are not accessible by other users.

Provided and/or discovered by:
Joey Hess

Changelog:
2006-03-21: Added CVE references.

Original Advisory:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356555