PT-2017-4790 · Ruby+2 · Ruby+2

Adam Mariš · Published 2015-10-05 · Updated 2018-03-28 · CVE-2009-5147

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Ruby versions 1.8, 1.9.0, 1.9.2, 1.9.3, 2.0.0 before patchlevel 648, and 2.1 before 2.1.8

Description: The issue concerns the DL::dlopen function in Ruby, which opens libraries with tainted names. This could potentially lead to security issues, but specific details about the estimated number of affected devices or real-world incidents are not provided.

Recommendations: For Ruby version 1.8, update to a version with the fix. For Ruby version 1.9.0, update to a version with the fix. For Ruby version 1.9.2, update to a version with the fix. For Ruby version 1.9.3, update to a version with the fix. For Ruby version 2.0.0 before patchlevel 648, update to patchlevel 648 or later. For Ruby version 2.1 before 2.1.8, update to version 2.1.8 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2016-2061

CVE-2009-5147

DLA-299-1

DLA-300-1

RHSA-2018:0583

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

SUSE-SU-2015:1889-1

USN-3365-1

Affected Products

Alt Linux

Ruby

Ubuntu

References · 25

• https://github.com/ruby/ruby/commit/4600cf725a86ce31266153647ae5aa1197b1215b · Patch
• https://ubuntu.com/security/CVE-2016-2339 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3365-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7551 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1889-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2009-5147 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2009-5147 · Security Note
• https://ruby-lang.org/en/news/2015/12/16/unsafe-tainted-string-usage-in-fiddle-and-dl-cve-2015-7551 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0583 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2337 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3365-1 · Vendor Advisory
• http://seclists.org/oss-sec/2015/q3/222 · Patch
• https://ubuntu.com/security/CVE-2016-7798 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-9096 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-1855 · Vendor Advisory