Lucene search

K
freebsdFreeBSD594EB447-E398-11D9-A8BD-000CF18BBE54
HistoryJun 22, 2005 - 12:00 a.m.

ruby -- arbitrary command execution on XMLRPC server

2005-06-2200:00:00
vuxml.freebsd.org
15

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.036

Percentile

91.7%

Nobuhiro IMAI reports:

the default value modification on
Module#public_instance_methods (from false to true) breaks
s.add_handler(XMLRPC::iPIMethods(“sample”), MyHandler.new) style
security protection.
This problem could allow a remote attacker to execute arbitrary
commands on XMLRPC server of libruby.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchruby< 1.8.2_3UNKNOWN
FreeBSDanynoarchruby_static< 1.8.2_3UNKNOWN

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.036

Percentile

91.7%