Executive Summary

Informations
Name CVE-2009-3086 First vendor Publication 2009-09-08
Vendor Cve Last vendor Modification 2019-08-08

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N)
Cvss Base Score 5 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3086

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-200 Information Exposure

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 8

OpenVAS Exploits

Date Description
2009-12-30 Name : Gentoo Security Advisory GLSA 200912-02 (rails)
File : nvt/glsa_200912_02.nasl
2009-10-27 Name : SuSE Security Summary SUSE-SR:2009:017
File : nvt/suse_sr_2009_017.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
57879 Ruby on Rails Cookie Store Unspecified Algorithm Message-digest Signature Ver...

Nessus® Vulnerability Scanner

Date Description
2011-06-15 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2260.nasl - Type : ACT_GATHER_INFO
2009-12-22 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-200912-02.nasl - Type : ACT_GATHER_INFO
2009-10-22 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_rubygem-actionpack-2_1-090917.nasl - Type : ACT_GATHER_INFO
2009-10-22 Name : The remote openSUSE host is missing a security update.
File : suse_11_1_rubygem-activesupport-2_1-090917.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/37427
CONFIRM http://weblog.rubyonrails.org/2009/9/4/timing-weakness-in-ruby-on-rails
DEBIAN http://www.debian.org/security/2011/dsa-2260
SECUNIA http://secunia.com/advisories/36600
SUSE http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
VUPEN http://www.vupen.com/english/advisories/2009/2544

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
Date Informations
2024-02-02 01:11:37
  • Multiple Updates
2024-02-01 12:03:14
  • Multiple Updates
2023-09-05 12:10:52
  • Multiple Updates
2023-09-05 01:03:05
  • Multiple Updates
2023-09-02 12:10:59
  • Multiple Updates
2023-09-02 01:03:07
  • Multiple Updates
2023-08-12 12:12:54
  • Multiple Updates
2023-08-12 01:03:06
  • Multiple Updates
2023-08-11 12:10:59
  • Multiple Updates
2023-08-11 01:03:14
  • Multiple Updates
2023-08-06 12:10:36
  • Multiple Updates
2023-08-06 01:03:08
  • Multiple Updates
2023-08-04 12:10:41
  • Multiple Updates
2023-08-04 01:03:10
  • Multiple Updates
2023-07-14 12:10:38
  • Multiple Updates
2023-07-14 01:03:08
  • Multiple Updates
2023-03-29 01:12:10
  • Multiple Updates
2023-03-28 12:03:14
  • Multiple Updates
2022-10-11 12:09:28
  • Multiple Updates
2022-10-11 01:02:57
  • Multiple Updates
2021-05-04 12:10:05
  • Multiple Updates
2021-04-22 01:10:28
  • Multiple Updates
2020-05-23 00:24:17
  • Multiple Updates
2019-08-09 12:03:04
  • Multiple Updates
2019-08-08 21:19:39
  • Multiple Updates
2016-04-26 19:05:24
  • Multiple Updates
2014-02-17 10:51:32
  • Multiple Updates
2013-05-10 23:56:47
  • Multiple Updates