Lucene search

K
freebsdFreeBSD1DAEA60A-4719-11DA-B5C6-0004614CC33D
HistoryOct 02, 2005 - 12:00 a.m.

ruby -- vulnerability in the safe level settings

2005-10-0200:00:00
vuxml.freebsd.org
14

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.021

Percentile

89.3%

Ruby home page reports:

The Object Oriented Scripting Language Ruby supports
safely executing an untrusted code with two mechanisms:
safe level and taint flag on objects.
A vulnerability has been found that allows bypassing
these mechanisms.
By using the vulnerability, arbitrary code can be executed
beyond the restrictions specified in each safe level.
Therefore, Ruby has to be updated on all systems that use
safe level to execute untrusted code.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchruby< 1.6.8.2004.07.28_2UNKNOWN
FreeBSDanynoarchruby_static< 1.6.8.2004.07.28_2UNKNOWN

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.021

Percentile

89.3%