Secunia

Joey Hess has reported some security issues in CGI::Session, which potentially can be exploited by malicious, local users and by malicious people to disclose certain sensitive information.

1) Session files are created by Driver::file, Driver::db_file, and Driver::sqlite with insecure default read permissions. This can potentially be exploited by malicious, local users to gain knowledge of data stored in session files, e.g. Driver::file stores the session files in "/tmp" by default.

2) The "cgisess.db" session file is created by Driver::db_file in the same directory as the CGI script. In certain configurations, this file may be created in a web accessible directory. This can potentially be exploited by malicious people to gain knowledge of session data.

The security issues have been reported in version 4.03. Other versions may also be affected.

Solution
Update to version 4.09.
Further details available in Customer Area

Provided and/or discovered by
Joey Hess

Changelog
Further details available in Customer Area

Original Advisory
Debian:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=356555

Deep Links
Links available in Customer Area