PT-2008-6895 · Ruby+1 · Ruby+1
Published
1970-01-01
·
Updated
2018-10-11
·
CVE-2008-3655
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Ruby versions 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423
Description
The issue allows context-dependent attackers to bypass intended access restrictions. This can be achieved via
untrace var, $PROGRAM NAME, and syslog at safe level 4, and insecure methods at safe levels 1 through 3. The exploitation of these vulnerabilities can lead to a disruption of protected information and can be performed remotely.Recommendations
For Ruby versions 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423, consider restricting access to critical variables and methods at various safe levels to prevent bypassing intended access restrictions. As a temporary workaround, consider disabling insecure methods at safe levels 1 through 3 until a patch is available. Restrict access to
untrace var, $PROGRAM NAME, and syslog at safe level 4 to minimize the risk of exploitation.Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Red Hat
Ruby