PT-2011-2808 · Ruby+1 · Ruby+1

Jan Lieskovsky · Publicado 2011-03-02 · Atualizado 2012-05-12 · CVE-2011-1004

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Média

Vetor base

AV:L/AC:M/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ruby versions 1.8.6 through 1.8.6-420 Ruby versions 1.8.7 through 1.8.7-330 Ruby version 1.8.8dev Ruby versions 1.9.1 through 1.9.1-430 Ruby versions 1.9.2 through 1.9.2-136 Ruby version 1.9.3dev

Description The issue allows local users to delete arbitrary files via a symlink attack, exploiting the FileUtils.remove entry secure method. This method is vulnerable to a symlink attack, enabling attackers to delete files they should not have access to.

Recommendations For Ruby versions 1.8.6 through 1.8.6-420, consider disabling the FileUtils.remove entry secure method until a patch is available. For Ruby versions 1.8.7 through 1.8.7-330, consider disabling the FileUtils.remove entry secure method until a patch is available. For Ruby version 1.8.8dev, consider disabling the FileUtils.remove entry secure method until a patch is available. For Ruby versions 1.9.1 through 1.9.1-430, consider disabling the FileUtils.remove entry secure method until a patch is available. For Ruby versions 1.9.2 through 1.9.2-136, consider disabling the FileUtils.remove entry secure method until a patch is available. For Ruby version 1.9.3dev, consider disabling the FileUtils.remove entry secure method until a patch is available.

Correção

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2011-1004

RHSA-2011:0909

RHSA-2011:0910

RHSA-2011_0909

RHSA-2011_0910

Produtos afetados

Red Hat

Ruby

Referências · 30

• http://ruby-lang.org/en/news/2011/02/18/fileutils-is-vulnerable-to-symlink-race-attacks · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2011/02/21/2 · Correção
• https://access.redhat.com/security/cve/CVE-2009-4492 · Nota
• http://redhat.com/support/errata/RHSA-2011-0910.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2011-0909.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-0541 · Nota
• https://access.redhat.com/security/cve/CVE-2011-0188 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-1004 · Nota de Segurança
• http://lists.apple.com/archives/security-announce/2012/May/msg00001.html · Aviso do Fabricante
• http://secunia.com/advisories/43434 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054422.html · Aviso do Fabricante
• http://secunia.com/advisories/43573 · Nota
• http://vupen.com/english/advisories/2011/0539 · Nota
• https://access.redhat.com/errata/RHSA-2011:0909 · Nota
• http://ush.it/team/ush/hack_httpd_escape/adv.txt · Nota