PT-2018-4234 · Ruby · Cap-Strap

Larry W. Cashdollar + 1 · Published 2018-01-10 · Updated 2018-03-16 · CVE-2014-4992

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cap-strap gem version 0.1.5

Description The issue allows local users to obtain sensitive information by listing the process, as credentials are placed on the useradd command line in the lib/cap-strap/helpers.rb file of the cap-strap gem for Ruby.

Recommendations For cap-strap gem version 0.1.5, consider updating to a newer version that does not place credentials on the command line, or as a temporary workaround, restrict access to sensitive information that could be exposed through process listing.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-4992

GHSA-PCM6-G2QP-9GW8

Affected Products

Cap-Strap

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cap-strap/CVE-2014-4992.yml · Exploit
• 🔥 http://vapid.dhs.org/advisories/cap-strap-0.1.5.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-4992 · Security Note
• https://osv.dev/vulnerability/GHSA-pcm6-g2qp-9gw8 · Vendor Advisory
• https://github.com/substantial/cap-strap · Note
• http://openwall.com/lists/oss-security/2014/07/07/9 · Note
• https://github.com/advisories/GHSA-pcm6-g2qp-9gw8 · Note
• http://openwall.com/lists/oss-security/2014/07/17/5 · Note