PT-2018-4245 · Ruby · Ciborg

Larry W. Cashdollar + 1 · Publicado 2018-01-10 · Atualizado 2018-07-23 · CVE-2014-5003

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions ciborg gem version 3.0.0

Description The issue concerns a /tmp file race condition in the chef/travis-cookbooks/ci environment/perlbrew/recipes/default.rb file of the ciborg gem. This allows a malicious local user to create a symlink attack on /tmp/perlbrew-installer, potentially overwriting the file's contents with their own code. This could lead to the execution of arbitrary code with the privileges of the ciborg process owner.

Recommendations For ciborg gem version 3.0.0, consider restricting access to the /tmp/perlbrew-installer file to prevent a malicious user from creating a symlink attack. As a temporary workaround, avoid using the chef/travis-cookbooks/ci environment/perlbrew/recipes/default.rb recipe until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2014-5003

GHSA-G982-9R8G-6QXW

Produtos afetados

Ciborg

Referências · 7

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ciborg/CVE-2014-5003.yml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-5003 · Nota de Segurança
• http://openwall.com/lists/oss-security/2014/07/07/24 · Nota
• http://vapid.dhs.org/advisories/ciborg-3.0.0.html · Nota
• https://osv.dev/vulnerability/GHSA-g982-9r8g-6qxw · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/07/17/5 · Nota
• https://github.com/advisories/GHSA-g982-9r8g-6qxw · Nota