PT-2013-3464 · Ruby · Ldoce Gem

Publicado 2013-04-03 · Atualizado 2017-10-24 · CVE-2013-1911

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ldoce gem version 0.0.2

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in an mp3 URL or file name. This is possible due to a flaw in the lib/ldoce/word.rb file of the ldoce gem for Ruby.

Recommendations For ldoce gem version 0.0.2, consider restricting the use of the lib/ldoce/word.rb file until a patch is available, and avoid using shell metacharacters in mp3 URLs or file names to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-1911

GHSA-G266-3CRH-H7GJ

Produtos afetados

Ldoce Gem

Referências · 12

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ldoce/CVE-2013-1911.yml · Exploit
• 🔥 http://openwall.com/lists/oss-security/2013/03/31/3 · Exploit
• 🔥 http://otiose.dhs.org/advisories/ldoce-0.0.2-cmd-exec.html · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2013-04/0010.html · Exploit
• 🔥 http://securityfocus.com/bid/58783 · Exploit
• https://github.com/markburns/ldoce/issues/1 · Nota
• https://github.com/markburns/ldoce · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-1911 · Nota de Segurança
• https://web.archive.org/web/20200229102422/http://securityfocus.com/bid/58783 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/83163 · Nota
• https://osv.dev/vulnerability/GHSA-g266-3crh-h7gj · Aviso do Fabricante
• http://osvdb.org/91870 · Nota