PT-2017-10699 · Ruby+5 · Ruby+5

Aerodudrizzt · Published 2017-09-15 · Updated 2020-06-09 · CVE-2017-0898

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 2.4.2 Ruby versions prior to 2.3.5 Ruby versions prior to 2.2.8

Description The issue is related to malicious format strings containing a precious specifier (*) with a huge minus value, which can lead to a buffer overrun. This situation may result in heap memory corruption or information disclosure from the heap.

Recommendations For versions prior to 2.4.2, update to version 2.4.2 or later. For versions prior to 2.3.5, update to version 2.3.5 or later. For versions prior to 2.2.8, update to version 2.2.8 or later.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

ALT-PU-2017-2216

CESA-2018_0378

CVE-2017-0898

DLA-1113-1

DLA-1114-1

DLA-1421-1

DSA-4031-1

MGASA-2017-0371

RHSA-2017:3485

RHSA-2018:0378

RHSA-2018:0583

RHSA-2018:0585

RHSA-2018_0378

SUSE-SU-2020:1570-1

SUSE-SU-2020_1570-1

USN-3439-1

USN-3685-1

Affected Products

Alt Linux

Centos

Red Hat

Ruby

Suse

Ubuntu

References · 132

• 🔥 https://github.com/mruby/mruby/issues/3722 · Exploit
• 🔥 https://github.com/rails-lts/json_cve_2020_10663 · Exploit
• 🔥 https://hackerone.com/reports/212241 · Exploit
• https://ubuntu.com/security/CVE-2017-0903 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-10784 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1421-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-0898 · Security Note
• https://ubuntu.com/security/notices/USN-3685-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-0898 · Vendor Advisory
• https://ruby-lang.org/en/news/2017/09/14/sprintf-buffer-underrun-cve-2017-0898 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0371 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3439-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-0898 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1000074 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-14064 · Vendor Advisory