PT-2010-4054 · Ruby · Ruby

Publicado 2010-07-09 · Atualizado 2017-08-17 · CVE-2010-2489

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 1.9.1-p429

Description A buffer overflow issue exists in Ruby on Windows, potentially allowing local users to gain privileges. This occurs when a crafted ARGF.inplace mode value is not properly handled during the construction of backup file filenames.

Recommendations For versions prior to 1.9.1-p429, update to version 1.9.1-p429 or later to resolve the issue. As a temporary workaround, consider restricting access to the ARGF.inplace mode value to minimize the risk of exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2010-2489

Produtos afetados

Ruby

Referências · 13

• https://exchange.xforce.ibmcloud.com/vulnerabilities/60135 · Nota
• http://osvdb.org/66040 · Nota
• http://secunia.com/advisories/40442 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-2489 · Nota de Segurança
• http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_rc1/ChangeLog · Nota
• http://svn.ruby-lang.org/repos/ruby/tags/v1_9_1_429/ChangeLog · Nota
• http://xforce.iss.net/xforce/xfdb/60135 · Nota
• http://securityfocus.com/bid/41321 · Nota
• http://osdir.com/ml/ruby-talk/2010-07/msg00095.html · Nota
• http://openwall.com/lists/oss-security/2010/07/02/1 · Nota
• http://ruby-lang.org/en/news/2010/07/02/ruby-1-9-1-p429-is-released · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2010/07/02/10 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2489 · Nota