PT-2010-4054 · Ruby · Ruby

Published 2010-07-09 · Updated 2017-08-17 · CVE-2010-2489

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 1.9.1-p429

Description A buffer overflow issue exists in Ruby on Windows, potentially allowing local users to gain privileges. This occurs when a crafted ARGF.inplace mode value is not properly handled during the construction of backup file filenames.

Recommendations For versions prior to 1.9.1-p429, update to version 1.9.1-p429 or later to resolve the issue. As a temporary workaround, consider restricting access to the ARGF.inplace mode value to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-2489

Affected Products

Ruby

References · 13

• http://secunia.com/advisories/40442 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-2489 · Security Note
• http://ruby-lang.org/en/news/2010/07/02/ruby-1-9-1-p429-is-released · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/60135 · Note
• http://osvdb.org/66040 · Note
• http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_rc1/ChangeLog · Note
• http://svn.ruby-lang.org/repos/ruby/tags/v1_9_1_429/ChangeLog · Note
• http://xforce.iss.net/xforce/xfdb/60135 · Note
• http://securityfocus.com/bid/41321 · Note
• http://osdir.com/ml/ruby-talk/2010-07/msg00095.html · Note
• http://openwall.com/lists/oss-security/2010/07/02/1 · Note
• http://openwall.com/lists/oss-security/2010/07/02/10 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2489 · Note