PT-2013-2141 · Ruby · Ruby Parser

Michael Scherer · Published 2013-03-01 · Updated 2023-02-13 · CVE-2013-0162

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions ruby parser gem versions 3.1.1 and earlier

Description The issue allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp. This is due to the diff pp function in lib/gauntlet rubyparser.rb.

Recommendations For ruby parser gem versions 3.1.1 and earlier, consider restricting access to the diff pp function in lib/gauntlet rubyparser.rb until a patch is available. As a temporary workaround, avoid using the diff pp function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

CWE-377

Related Identifiers

CVE-2013-0162

GHSA-8MVW-22R7-W6FQ

RHSA-2013:0582

Affected Products

Ruby Parser

References · 16

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby_parser/CVE-2013-0162.yml · Exploit
• http://rhn.redhat.com/errata/RHSA-2013-0544.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0548.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-0162 · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-0162 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2013-0162 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=892806 · Patch
• https://osv.dev/vulnerability/GHSA-8mvw-22r7-w6fq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0162 · Security Note
• https://github.com/seattlerb/ruby_parser · Note
• https://github.com/seattlerb/ruby_parser/commit/506c7e13cff6f8715385fa8488b621028b4ad280 · Note
• https://github.com/seattlerb/ruby_parser/commit/c35acd878d50a8e4ea35933e3fbdc493421d422c · Note
• https://access.redhat.com/security/cve/CVE-2013-0162 · Note
• https://access.redhat.com/errata/RHSA-2013:0582 · Note
• https://access.redhat.com/errata/RHSA-2013:0544 · Note