PT-2018-4242 · Ruby · Lawn-Login Gem

Larry W. Cashdollar + 1 · Publicado 2018-01-10 · Atualizado 2018-01-30 · CVE-2014-5000

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions lawn-login gem version 0.0.7

Description The issue concerns the login function in the lawn-login gem for Ruby, which places credentials on the curl command line. This allows local users to obtain sensitive information by listing the process. The lib/lawn.rb file is specifically affected.

Recommendations For version 0.0.7, consider modifying the login function to avoid placing credentials on the command line, or restrict access to process listings to minimize the risk of exploitation. As a temporary workaround, consider disabling the login function until a patch is available.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-5000

GHSA-RHGQ-VV9X-J4P5

Produtos afetados

Lawn-Login Gem

Referências · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lawn-login/CVE-2014-5000.yml · Exploit
• 🔥 http://vapid.dhs.org/advisories/lawn-login-0.0.7.html · Exploit
• https://github.com/skalnik/lawn-login · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-5000 · Nota de Segurança
• https://web.archive.org/web/20200229060607/http://vapid.dhs.org/advisories/lawn-login-0.0.7.html · Nota
• https://osv.dev/vulnerability/GHSA-rhgq-vv9x-j4p5 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/07/17/5 · Nota
• http://openwall.com/lists/oss-security/2014/07/07/20 · Nota