Bug 887877 (CVE-2014-4975) - VUL-1: CVE-2014-4975: ruby20: off-by-one stack-based buffer overflow in the encodes() function
Summary: VUL-1: CVE-2014-4975: ruby20: off-by-one stack-based buffer overflow in the e...
Status: RESOLVED FIXED
Alias: CVE-2014-4975
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.1
: P4 - Low : Minor
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/103821/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-18 07:41 UTC by Victor Pereira
Modified: 2017-04-28 16:12 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2014-07-18 07:41:15 UTC
CVE-2014-4975:

A possible stack-based buffer overflow flaw was reported in the Ruby encodes() function from pack.c. From the bug report, this function may be used on data received from a server, and could be triggered remotely.

As the affected stack buffer is a static size on the stack, FORTIFY_SOURCE may help mitigate this issue to only be a denial of service.

The original report suggests older versions (such as 1.9.3) are not affected.


References:
https://bugs.ruby-lang.org/issues/10019
http://www.openwall.com/lists/oss-security/2014/07/09/13
https://bugzilla.redhat.com/show_bug.cgi?id=1118158
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-4975
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4975
Comment 2 Jordi Massaguer 2014-07-18 11:27:40 UTC
assigning to darix. I am on vacation next week and I think he is the appropiate person to fix it.
Comment 3 Swamp Workflow Management 2014-07-18 22:00:48 UTC
bugbot adjusting priority
Comment 4 Marcus Rückert 2014-07-21 15:44:35 UTC
JFYI this only seems to apply to 32bit.
Comment 5 Marcus Meissner 2014-09-02 12:28:36 UTC
can you submit fixes?
Comment 6 Marcus Meissner 2014-09-11 16:20:12 UTC
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=46778

current fix

i see nothing 32bit specific in there.
Comment 7 Marcus Rückert 2014-10-08 16:25:27 UTC
JFYI: i cant reproduce the issue on sle11 32bit ruby.
Comment 8 Marcus Rückert 2014-10-08 16:56:36 UTC
1. rh bugzilla seems also to indicate 1.8 not affected
2. i have patches ready for everything but sle 12. there i would recommend to bump to 2.1.3 and take the GC improvements
https://www.ruby-lang.org/en/news/2014/09/19/ruby-2-1-3-is-released/

thoughts?
Comment 9 Victor Pereira 2014-10-09 07:16:59 UTC
+1 for 2.1.3
Comment 11 Marcus Rückert 2017-03-07 13:09:14 UTC
SLE12: this is covered by the update to 2.1.9
Comment 12 Swamp Workflow Management 2017-04-20 10:09:32 UTC
SUSE-SU-2017:1067-1: An update that solves 5 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1014863,1018808,887877,909695,926974,936032,959495,986630
CVE References: CVE-2014-4975,CVE-2015-1855,CVE-2015-3900,CVE-2015-7551,CVE-2016-2339
Sources used:
SUSE Linux Enterprise Software Development Kit 12-SP2 (src):    ruby2.1-2.1.9-15.1
SUSE Linux Enterprise Software Development Kit 12-SP1 (src):    ruby2.1-2.1.9-15.1
SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src):    ruby2.1-2.1.9-15.1
SUSE Linux Enterprise Server 12-SP2 (src):    ruby2.1-2.1.9-15.1
SUSE Linux Enterprise Server 12-SP1 (src):    ruby2.1-2.1.9-15.1
SUSE Linux Enterprise Desktop 12-SP2 (src):    ruby2.1-2.1.9-15.1
SUSE Linux Enterprise Desktop 12-SP1 (src):    ruby2.1-2.1.9-15.1
OpenStack Cloud Magnum Orchestration 7 (src):    ruby2.1-2.1.9-15.1
Comment 13 Swamp Workflow Management 2017-04-28 16:12:05 UTC
openSUSE-SU-2017:1128-1: An update that solves 5 vulnerabilities and has three fixes is now available.

Category: security (important)
Bug References: 1014863,1018808,887877,909695,926974,936032,959495,986630
CVE References: CVE-2014-4975,CVE-2015-1855,CVE-2015-3900,CVE-2015-7551,CVE-2016-2339
Sources used:
openSUSE Leap 42.2 (src):    ruby2.1-2.1.9-8.3.2
openSUSE Leap 42.1 (src):    ruby2.1-2.1.9-10.2