Showing posts with label Ruby. Show all posts
Showing posts with label Ruby. Show all posts

Ruby-Arbitrary code execution vulnerabilities

Sunday, July 6, 2008 by Mzer0 , ,

Multiple vulnerabilities in Ruby may lead to a denial of service (DoS) condition or allow execution of arbitrary code.

Impact

With the following vulnerabilities, an attacker can lead to denial of service condition or execute arbitrary code.

Vulnerable versions

1.8 series
  • 1.8.4 and all prior versions
  • 1.8.5-p230 and all prior versions
  • 1.8.6-p229 and all prior versions
  • 1.8.7-p21 and all prior versions
1.9 series
  • 1.9.0-1 and all prior versions

Solution

1.8 series
Please upgrade to 1.8.5-p231, or 1.8.6-p230, or 1.8.7-p22.
  • (md5sum: e900cf225d55414bffe878f00a85807c)
  • (md5sum: 5e8247e39be2dc3c1a755579c340857f)
  • (md5sum: fc3ede83a98f48d8cb6de2145f680ef2)
1.9 series
Please upgrade to 1.9.0-2.
  • (md5sum: 2a848b81ed1d6393b88eec8aa6173b75)

These versions also fix the vulnerability of WEBrick (CVE-2008-1891).

Please note that a package that corrects this weakness may already be available through your package management software.

Credit

Credit to Drew Yao of Apple Product Security for disclosing the problem to Ruby Security Team.

Changes

  • 2008-06-21 00:29 +09:00 removed wrong CVE IDs (CVE-2008-2727, CVE-2008-2728).

[Source:Ruby-lang]

0 comments

 

Apple security team finds code execution holes in Ruby

Friday, June 20, 2008 by Mzer0 , , ,

Code execution holes in Ruby




A member of Apple’s security team has discovered multiple serious security vulnerabilities in Ruby, the popular open-source scripting language.

According to an advisory on the Ruby project site, Apple’s Drew Yao reported at least six of the vulnerabilities, which can be exploited to cause a denial-of-service  condition or the execution of arbitrary code.

The issues were confirmed in the 1.8 and 1.9 versions of Ruby.  Patch download locations can be found in the alert.

Ruby, initially developed and designed by Yukihiro “Matz” Matsumoto, is the interpreted scripting language for quick and easy object-oriented programming.



[Source: Zdnet]


0 comments