PT-2012-5962 · Ruby+1 · Ruby+1

Published 2012-10-11 · Updated 2024-08-06 · CVE-2012-5380

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ruby version 1.9.3-p194

Description The installation functionality in Ruby has an untrusted search path vulnerability when installed in the top-level C: directory. This might allow local users to gain privileges via a Trojan horse DLL in the C:Ruby193bin directory, which may be added to the PATH system environment variable by an administrator. A demonstration of this issue involves a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in various Windows versions.

Recommendations For Ruby version 1.9.3-p194, consider restricting access to the C:Ruby193bin directory to minimize the risk of exploitation. As a temporary workaround, avoid adding the C:Ruby193bin directory to the PATH system environment variable until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2014-1334

CVE-2012-5380

Affected Products

Alt Linux

Ruby

References · 11

• 🔥 https://exploit-db.com/exploits/28130 · Exploit
• 🔥 https://htbridge.com/advisory/HTB23108 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4073 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-5380 · Security Note
• https://errata.altlinux.org/ALT-PU-2014-1334 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5371 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5380 · Security Note
• https://t.me/cvenotify/89522 · Telegram Post
• https://packages.altlinux.org/ru/vuln/CVE-2012-5380 · Note
• https://t.me/cvenotify/81977 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5380 · Note