PT-2013-3523 · Ruby+1 · Ruby+1

Publicado 2013-11-02 · Atualizado 2018-10-30 · CVE-2013-2065

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions 1.9 before 1.9.3 patchlevel 426 Ruby versions 2.0 before 2.0.0 patchlevel 195

Description The issue allows context-dependent attackers to bypass intended $SAFE level restrictions due to the lack of taint checking for native functions in certain Ruby versions.

Recommendations For Ruby versions 1.9 before 1.9.3 patchlevel 426, update to version 1.9.3 patchlevel 426 or later. For Ruby versions 2.0 before 2.0.0 patchlevel 195, update to version 2.0.0 patchlevel 195 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2016-2061

CVE-2013-2065

DLA-235-1

Produtos afetados

Alt Linux

Ruby

Referências · 40

• 🔥 https://ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065 · Exploit
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/rails_json_float_dos.rb · Nota
• http://packetstormsecurity.com/files/126218/Ruby-OpenSSL-Private-Key-Spoofing.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4287 · Nota de Segurança
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107120.html · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1855 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0256 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16254 · Nota de Segurança
• http://seclists.org/fulldisclosure/2014/Apr/231 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4363 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8090 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4164 · Nota de Segurança
• https://packages.altlinux.org/ru/vuln/CVE-2013-2065 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5147 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2013-2065 · Nota de Segurança