PT-2008-6895 · Ruby+1 · Ruby+1
Publicado
1970-01-01
·
Atualizado
2018-10-11
·
CVE-2008-3655
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Ruby versions 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423
Description
The issue allows context-dependent attackers to bypass intended access restrictions. This can be achieved via
untrace var, $PROGRAM NAME, and syslog at safe level 4, and insecure methods at safe levels 1 through 3. The exploitation of these vulnerabilities can lead to a disruption of protected information and can be performed remotely.Recommendations
For Ruby versions 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423, consider restricting access to critical variables and methods at various safe levels to prevent bypassing intended access restrictions. As a temporary workaround, consider disabling insecure methods at safe levels 1 through 3 until a patch is available. Restrict access to
untrace var, $PROGRAM NAME, and syslog at safe level 4 to minimize the risk of exploitation.Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Red Hat
Ruby