CVE ID:	CVE-2007-6077
Description:	The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
Test IDs:	1.3.6.1.4.1.25623.1.0.59647
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2007-6077 http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html BugTraq ID: 26598 http://www.securityfocus.com/bid/26598 Cert/CC Advisory: TA07-352A http://www.us-cert.gov/cas/techalerts/TA07-352A.html http://secunia.com/advisories/27781 http://secunia.com/advisories/28136 http://www.vupen.com/english/advisories/2007/4009 http://www.vupen.com/english/advisories/2007/4238