PT-2005-2939 · Ruby+1 · Libruby+1

Nobuhiro Imai · Publicado 2005-06-20 · Atualizado 2017-10-11 · CVE-2005-1992

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libruby version 1.8

Description The issue concerns the XMLRPC server in the utils.rb file for the ruby library, where an invalid default value is set. This prevents the use of handlers for security protection, allowing remote attackers to execute arbitrary commands.

Recommendations For libruby version 1.8, update the utils.rb file to set a valid default value to prevent remote command execution.

Correção

Identificadores relacionados

CVE-2005-1992

DSA-748-1

RHSA-2005:543

RHSA-2005_543

Produtos afetados

Red Hat

Libruby

Referências · 16

• http://ciac.org/ciac/bulletins/p-312.shtml · Nota
• http://securityfocus.com/bid/14016 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10819 · Nota
• http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237 · Correção
• http://kb.cert.org/vuls/id/684913 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2005-1992 · Nota de Segurança
• http://lists.apple.com/archives/security-announce/2005/Sep/msg00002.html · Aviso do Fabricante
• http://www2.ruby-lang.org/en/20050701.html · Nota
• http://redhat.com/support/errata/RHSA-2005-543.html · Aviso do Fabricante
• https://rhn.redhat.com/errata/RHSA-2005-543.html · Nota
• http://debian.org/security/2005/dsa-748 · Aviso do Fabricante
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064 · Nota
• http://auscert.org.au/5509 · Nota
• https://redhat.com/security/data/cve/CVE-2005-1992.html · Nota
• http://novell.com/linux/security/advisories/2005_18_sr.html · Aviso do Fabricante