PT-2010-1350 · Ruby+1 · Ruby+1

Alessandro Tanasi

+5

·

Publicado

2010-01-13

·

Atualizado

2023-08-01

·

CVE-2009-4492

CVSS v2.0

7.5

Alta

VetorAV:N/AC:L/Au:N/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Ruby versions 1.8.6 through patchlevel 383 Ruby versions 1.8.7 through patchlevel 248 Ruby version 1.8.8dev Ruby versions 1.9.1 through patchlevel 376 Ruby version 1.9.2dev
Description The issue allows remote attackers to potentially modify a window's title or execute arbitrary commands via an HTTP request containing an escape sequence for a terminal emulator, as WEBrick writes data to a log file without sanitizing non-printable characters.
Recommendations For Ruby versions 1.8.6 through patchlevel 383, update to a version with the necessary security patches. For Ruby versions 1.8.7 through patchlevel 248, update to a version with the necessary security patches. For Ruby version 1.8.8dev, apply the available security fix. For Ruby versions 1.9.1 through patchlevel 376, update to a version with the necessary security patches. For Ruby version 1.9.2dev, apply the available security fix.

Exploit

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2009-4492
GHSA-6MQ2-37J5-W6R6
RHSA-2011:0908
RHSA-2011:0909
RHSA-2011_0908
RHSA-2011_0909

Produtos afetados

Red Hat
Ruby