PT-2011-2600 · Ruby · Ruby Mail Gem

Published 2011-02-02 · Updated 2017-10-24 · CVE-2011-0739

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ruby Mail gem versions 2.2.14 and earlier

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address. This is due to a problem in the deliver function in the sendmail delivery agent, specifically in the lib/mail/network/delivery methods/sendmail.rb file.

Recommendations For Ruby Mail gem versions 2.2.14 and earlier, consider disabling the deliver function in the sendmail delivery agent until a patch is available. Restrict access to the lib/mail/network/delivery methods/sendmail.rb file to minimize the risk of exploitation. Avoid using e-mail addresses with shell metacharacters in the affected delivery agent until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-0739

GHSA-CPJC-P7FC-J9XH

Affected Products

Ruby Mail Gem

References · 12

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/mail/CVE-2011-0739.yml · Exploit
• https://github.com/mikel/mail/raw/master/patches/20110126_sendmail.patch · Patch
• http://vupen.com/english/advisories/2011/0233 · Vendor Advisory
• http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1 · Patch
• https://osv.dev/vulnerability/GHSA-cpjc-p7fc-j9xh · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0739 · Security Note
• http://secunia.com/advisories/43077 · Vendor Advisory
• https://github.com/mikel/mail · Note
• http://securityfocus.com/bid/46021 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/65010 · Note
• http://osvdb.org/70667 · Note
• https://web.archive.org/web/20200228225346/http://securityfocus.com/bid/46021 · Note