PT-2013-3523 · Ruby+1 · Ruby+1

Published 2013-11-02 · Updated 2018-10-30 · CVE-2013-2065

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions 1.9 before 1.9.3 patchlevel 426 Ruby versions 2.0 before 2.0.0 patchlevel 195

Description The issue allows context-dependent attackers to bypass intended $SAFE level restrictions due to the lack of taint checking for native functions in certain Ruby versions.

Recommendations For Ruby versions 1.9 before 1.9.3 patchlevel 426, update to version 1.9.3 patchlevel 426 or later. For Ruby versions 2.0 before 2.0.0 patchlevel 195, update to version 2.0.0 patchlevel 195 or later.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2016-2061

CVE-2013-2065

DLA-235-1

Affected Products

Alt Linux

Ruby

References · 40

• 🔥 https://ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4287 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107120.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1855 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0256 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16254 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4363 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8090 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4164 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5147 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-2065 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4466 · Security Note
• https://errata.altlinux.org/ALT-PU-2016-2061 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7551 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4522 · Security Note