PT-2012-5459 · Ruby+3 · Ruby+3

Peter Bex · Publicado 2012-11-24 · Atualizado 2016-10-03 · CVE-2012-4522

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions 1.9.3 before patchlevel 286 Ruby versions 2.0.0 before r37163

Description The issue allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path. This is due to a problem in the rb get path check function in file.c.

Recommendations For Ruby versions 1.9.3 before patchlevel 286, update to patchlevel 286 or later. For Ruby versions 2.0.0 before r37163, update to r37163 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2016-2061

CVE-2012-4522

DLA-235-1

RHSA-2013:0129

RHSA-2013:0582

RHSA-2013_0129

SUSE-SU-2013_0435-1

Produtos afetados

Alt Linux

Red Hat

Ruby

Suse

Referências · 52

• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/rails_json_float_dos.rb · Nota
• https://ruby-lang.org/en/news/2014/11/13/rexml-dos-cve-2014-8090 · Nota
• http://seclists.org/fulldisclosure/2014/Apr/231 · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://errata.altlinux.org/ALT-PU-2016-2061 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4466 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0256 · Nota de Segurança
• https://bugzilla.novell.com/783525 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4522 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4363 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5147 · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-04073 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2012-4522 · Nota
• https://bdu.fstec.ru/vul/2020-00866 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2012-4522 · Nota