Bugzilla – Bug 673750
VUL-0: CVE-2011-1005: ruby: Exception methods can bypass $SAFE
Last modified: 2016-08-09 20:25:50 UTC
Hi. There is a security bug in package 'rubygem-rails'. This bug is public. There is no coordinated release date (CRD) set. More information can be found here: http://www.ruby-lang.org/en/news/2011/02/18/exception-methods-can-bypass-safe/ Original posting: @assigned = mrueckert@novell.com http://www.ruby-lang.org/en/news/2011/02/18/exception-methods-can-bypass-safe/ Exception#to_s method can be used to trick $SAFE check, which makes a untrusted codes to modify arbitrary strings.
CVE-2011-1005
CVE-2011-1005: CVSS v2 Base Score: 4.3 (low) (AV:N/AC:M/Au:N/C:N/I:P/A:N)
The SWAMPID for this issue is 38896. This issue was rated as important. Please submit fixed packages until 2011-03-01. When done, please reassign the bug to security-team@suse.de. Patchinfo will be handled by security team.
Created attachment 417599 [details] test case for the bug. with the fix working, you should get [[[ $ ruby test-exception-taint.rb test-exception-taint.rb:8:in `replace': Insecure: can't modify string (SecurityError) from test-exception-taint.rb:8 from test-exception-taint.rb:5:in `call' from test-exception-taint.rb:5 ]]] without the fix you will see your /etc/passwd
Update released for: ruby, ruby-debuginfo, ruby-debugsource, ruby-devel, ruby-doc-html, ruby-doc-ri, ruby-examples, ruby-test-suite, ruby-tk, ruby-tk-debuginfo Products: openSUSE 11.3 (debug, i586, x86_64)
Update released for: ruby, ruby-debuginfo, ruby-debugsource, ruby-devel, ruby-doc-html, ruby-doc-ri, ruby-examples, ruby-test-suite, ruby-tk Products: SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-DESKTOP 11-SP1 (i386, x86_64) SLE-SDK 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-SLMS 1.1 (x86_64) SLE-STUDIOONSITE 1.1 (x86_64) SLE-WEBYAST 1.0-SP1 (i386, ia64, ppc64, s390x, x86_64) SLE-WEBYAST 1.1 (i386, x86_64) SLES4VMWARE 11-SP1 (i386, x86_64)
This is an autogenerated message for OBS integration: This bug (673750) was mentioned in https://build.opensuse.org/request/show/72199 Evergreen:11.2 / ruby
Can this now be closed?
done
Additional issues (CVE 2012-4464 and CVE 2012-4466) revealed that the original fix for addressing this issue has been incomplete. Therefore, we have a fourth assigned: CVE-2012-4481. Detailed explanation by Jan Lieskovsky of Red Hat available on oss [1]. [1] http://www.openwall.com/lists/oss-security/2012/10/05/2
the new issues are tracked in different bugs.