PT-2013-4880 · Ruby+4 · Ruby+4
Charlie Somerville
·
Published
2013-11-22
·
Updated
2018-01-09
·
CVE-2013-4164
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Ruby versions 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2
Description
A heap-based buffer overflow issue allows context-dependent attackers to cause a denial of service and possibly execute arbitrary code via a string that is converted to a floating point value. This can be demonstrated using the
to f method or JSON.parse.Recommendations
For Ruby version 1.8, update to a version that is not affected by this issue.
For Ruby version 1.9 before 1.9.3-p484, update to version 1.9.3-p484 or later.
For Ruby version 2.0 before 2.0.0-p353, update to version 2.0.0-p353 or later.
For Ruby version 2.1 before 2.1.0 preview2, update to version 2.1.0 preview2 or later.
As a temporary workaround, consider restricting the use of the
to f method and JSON.parse function until a patch is available.Exploit
Fix
DoS
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Red Hat
Ruby
Suse