PT-2013-3464 · Ruby · Ldoce Gem

Published 2013-04-03 · Updated 2017-10-24 · CVE-2013-1911

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions ldoce gem version 0.0.2

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in an mp3 URL or file name. This is possible due to a flaw in the lib/ldoce/word.rb file of the ldoce gem for Ruby.

Recommendations For ldoce gem version 0.0.2, consider restricting the use of the lib/ldoce/word.rb file until a patch is available, and avoid using shell metacharacters in mp3 URLs or file names to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-1911

GHSA-G266-3CRH-H7GJ

Affected Products

Ldoce Gem

References · 12

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ldoce/CVE-2013-1911.yml · Exploit
• 🔥 http://openwall.com/lists/oss-security/2013/03/31/3 · Exploit
• 🔥 http://otiose.dhs.org/advisories/ldoce-0.0.2-cmd-exec.html · Exploit
• 🔥 http://archives.neohapsis.com/archives/bugtraq/2013-04/0010.html · Exploit
• 🔥 http://securityfocus.com/bid/58783 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1911 · Security Note
• https://osv.dev/vulnerability/GHSA-g266-3crh-h7gj · Vendor Advisory
• https://github.com/markburns/ldoce/issues/1 · Note
• https://github.com/markburns/ldoce · Note
• https://web.archive.org/web/20200229102422/http://securityfocus.com/bid/58783 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/83163 · Note
• http://osvdb.org/91870 · Note