PT-2005-5567 · Ruby+1 · Ruby+1

Yutaka Oiwa · Published 1970-01-01 · Updated 2017-10-11 · CVE-2005-2337

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ruby versions 1.6.x up to 1.6.8 Ruby versions 1.8.x up to 1.8.2 Ruby version 1.9.0 development up to 2005-09-01

Description The issue allows attackers to bypass safe level and taint flag protections and execute disallowed code when Ruby processes a program through standard input. Multiple vulnerabilities in the Ruby package may lead to a breach of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For Ruby versions 1.6.x up to 1.6.8, update to a version later than 1.6.8 to resolve the issue. For Ruby versions 1.8.x up to 1.8.2, update to a version later than 1.8.2 to resolve the issue. For Ruby version 1.9.0 development up to 2005-09-01, update to a version later than 2005-09-01 to resolve the issue.

Fix

Related Identifiers

BDU:2015-02405

BDU:2015-02406

CVE-2005-2337

DSA-860-1

DSA-862-1

DSA-864-1

RHSA-2005:799

RHSA-2005_799

Affected Products

Red Hat

Ruby

References · 35

• http://secunia.com/advisories/20077 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2337 · Security Note
• http://secunia.com/advisories/17147 · Vendor Advisory
• http://ruby-lang.org/en/20051003.html · Vendor Advisory
• http://debian.org/security/2005/dsa-864 · Vendor Advisory
• http://secunia.com/advisories/17285 · Vendor Advisory
• http://secunia.com/advisories/17098 · Vendor Advisory
• http://debian.org/security/2005/dsa-862 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2005-799.html · Vendor Advisory
• http://ubuntu.com/usn/usn-195-1 · Vendor Advisory
• http://secunia.com/advisories/16904 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2005-2337 · Security Note
• http://lists.apple.com/archives/security-announce/2006/May/msg00003.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDKSA-2005:191 · Vendor Advisory
• http://novell.com/linux/security/advisories/2006_05_sr.html · Vendor Advisory