PT-2013-1678 · Ruby+3 · Ruby+3

Shugo Maedo + 1 · Publicado 2013-01-08 · Atualizado 2023-02-13 · CVE-2012-4481

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruby version 1.8.7

Description The safe-level feature in Ruby allows context-dependent attackers to modify strings via the NameError#to s method when operating on Ruby objects.

Recommendations For Ruby version 1.8.7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CESA-2013_0612

CVE-2012-4481

RHSA-2013:0129

RHSA-2013:0612

RHSA-2013_0129

RHSA-2013_0612

SUSE-SU-2014_0844-1

Produtos afetados

Centos

Red Hat

Ruby

Suse

Referências · 36

• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/rails_json_float_dos.rb · Nota
• https://lists.centos.org/pipermail/centos-announce/2013-March/031671.html · Nota
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• http://support.novell.com/security/cve/CVE-2013-1821.html · Nota
• https://bugzilla.novell.com/783525 · Nota
• http://support.novell.com/security/cve/CVE-2012-4481.html · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=863484 · Nota
• https://bugzilla.novell.com/851803 · Nota
• https://lists.centos.org/pipermail/centos-announce/2013-March/081795.html · Nota
• https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0294 · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0612.html · Aviso do Fabricante
• https://rhn.redhat.com/errata/RHSA-2013-0612.html · Nota
• https://access.redhat.com/security/cve/CVE-2012-4522 · Nota
• http://openwall.com/lists/oss-security/2012/10/05/4 · Nota
• http://download.suse.com/patch/finder/?keywords=9bc15e1f428f15de04cd5d99f4b7aa3d · Nota