PT-2013-1677 · Ruby+2 · Ruby+2

Shugo Maedo + 1 · Publicado 2013-04-25 · Atualizado 2016-10-03 · CVE-2012-4466

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions 1.8.7 before patchlevel 371 Ruby versions 1.9.3 before patchlevel 286 Ruby versions 2.0 before revision r37068

Description The issue allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name err mesg to str API function. This function marks the string as tainted.

Recommendations For Ruby version 1.8.7, update to patchlevel 371 or later. For Ruby version 1.9.3, update to patchlevel 286 or later. For Ruby version 2.0, update to revision r37068 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2016-2061

CVE-2012-4466

RHSA-2013:0582

Produtos afetados

Alt Linux

Ruby

Suse

Referências · 43

• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/rails_json_float_dos.rb · Nota
• https://ruby-lang.org/en/news/2014/11/13/rexml-dos-cve-2014-8090 · Nota
• http://seclists.org/fulldisclosure/2014/Apr/231 · Nota
• https://errata.altlinux.org/ALT-PU-2016-2061 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4466 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0256 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4363 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5147 · Nota de Segurança
• https://bdu.fstec.ru/vul/2020-04073 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2012-4466 · Nota de Segurança
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0294 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089554.html · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2020-00866 · Nota de Segurança
• https://ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4464 · Nota de Segurança