PT-2008-4170 · Ruby+1 · Ruby+1

Publicado 2008-06-24 · Atualizado 2018-11-01 · CVE-2008-2726

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Ruby versions 1.6.x Ruby versions 1.8.4 and earlier Ruby versions 1.8.5 through 1.8.5-p230 Ruby versions 1.8.6 through 1.8.6-p229 Ruby versions 1.8.7 through 1.8.7-p21 Ruby versions 1.9.0 through 1.9.0-1

Description The issue is related to an integer overflow in the rb ary splice function and the rb ary replace function, which can lead to memory corruption. This can be exploited by context-dependent attackers.

Recommendations For Ruby version 1.6.x, consider upgrading to a newer version to resolve the issue. For Ruby versions 1.8.4 and earlier, upgrade to version 1.8.5-p231 or later. For Ruby versions 1.8.5 through 1.8.5-p230, upgrade to version 1.8.5-p231 or later. For Ruby versions 1.8.6 through 1.8.6-p229, upgrade to version 1.8.6-p230 or later. For Ruby versions 1.8.7 through 1.8.7-p21, upgrade to version 1.8.7-p22 or later. For Ruby versions 1.9.0 through 1.9.0-1, upgrade to version 1.9.0-2 or later.

Correção

Enumeração de Fraquezas

CWE-189

Identificadores relacionados

CVE-2008-2726

DSA-1612-1

DSA-1618-1

RHSA-2008:0561

RHSA-2008:0562

RHSA-2008_0561

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

Produtos afetados

Red Hat

Ruby

Referências · 44

• http://matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities · Nota
• http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2008:140 · Aviso do Fabricante
• http://mandriva.com/security/advisories?name=MDVSA-2008:142 · Aviso do Fabricante
• http://secunia.com/advisories/30831 · Nota
• http://secunia.com/advisories/31062 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9959 · Nota
• http://secunia.com/advisories/33178 · Nota
• http://support.apple.com/kb/HT2163 · Nota
• https://bugs.launchpad.net/ubuntu/+source/ruby1.8/+bug/241657 · Nota
• http://security.gentoo.org/glsa/glsa-200812-17.xml · Aviso do Fabricante
• http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.429562 · Aviso do Fabricante
• http://ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities · Aviso do Fabricante
• http://debian.org/security/2008/dsa-1612 · Aviso do Fabricante
• http://secunia.com/advisories/31687 · Nota