PT-2005-2939 · Ruby+1 · Libruby+1

Nobuhiro Imai · Published 2005-06-20 · Updated 2017-10-11 · CVE-2005-1992

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libruby version 1.8

Description The issue concerns the XMLRPC server in the utils.rb file for the ruby library, where an invalid default value is set. This prevents the use of handlers for security protection, allowing remote attackers to execute arbitrary commands.

Recommendations For libruby version 1.8, update the utils.rb file to set a valid default value to prevent remote command execution.

Fix

Related Identifiers

CVE-2005-1992

DSA-748-1

RHSA-2005:543

RHSA-2005_543

Affected Products

Red Hat

Libruby

References · 16

• http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-1992 · Security Note
• http://lists.apple.com/archives/security-announce/2005/Sep/msg00002.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-543.html · Vendor Advisory
• http://debian.org/security/2005/dsa-748 · Vendor Advisory
• http://novell.com/linux/security/advisories/2005_18_sr.html · Vendor Advisory
• http://ciac.org/ciac/bulletins/p-312.shtml · Note
• http://securityfocus.com/bid/14016 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10819 · Note
• http://kb.cert.org/vuls/id/684913 · Note
• http://www2.ruby-lang.org/en/20050701.html · Note
• https://rhn.redhat.com/errata/RHSA-2005-543.html · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064 · Note
• http://auscert.org.au/5509 · Note
• https://redhat.com/security/data/cve/CVE-2005-1992.html · Note