PT-2008-4170 · Ruby+1 · Ruby+1

Published 2008-06-24 · Updated 2018-11-01 · CVE-2008-2726

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Ruby versions 1.6.x Ruby versions 1.8.4 and earlier Ruby versions 1.8.5 through 1.8.5-p230 Ruby versions 1.8.6 through 1.8.6-p229 Ruby versions 1.8.7 through 1.8.7-p21 Ruby versions 1.9.0 through 1.9.0-1

Description The issue is related to an integer overflow in the rb ary splice function and the rb ary replace function, which can lead to memory corruption. This can be exploited by context-dependent attackers.

Recommendations For Ruby version 1.6.x, consider upgrading to a newer version to resolve the issue. For Ruby versions 1.8.4 and earlier, upgrade to version 1.8.5-p231 or later. For Ruby versions 1.8.5 through 1.8.5-p230, upgrade to version 1.8.5-p231 or later. For Ruby versions 1.8.6 through 1.8.6-p229, upgrade to version 1.8.6-p230 or later. For Ruby versions 1.8.7 through 1.8.7-p21, upgrade to version 1.8.7-p22 or later. For Ruby versions 1.9.0 through 1.9.0-1, upgrade to version 1.9.0-2 or later.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2008-2726

DSA-1612-1

DSA-1618-1

RHSA-2008:0561

RHSA-2008:0562

RHSA-2008_0561

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

Affected Products

Red Hat

Ruby

References · 44

• http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:140 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:142 · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-200812-17.xml · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.429562 · Vendor Advisory
• http://ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities · Vendor Advisory
• http://debian.org/security/2008/dsa-1612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2726 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-June/msg00937.html · Vendor Advisory
• http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=17460 · Vendor Advisory
• http://ubuntu.com/usn/usn-621-1 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:141 · Vendor Advisory
• http://debian.org/security/2008/dsa-1618 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0561.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html · Vendor Advisory