Lucene search

K

RubySecRUBY:RUBY-2008-3655

HistoryAug 07, 2008 - 8:00 p.m.

Ruby multiple insufficient safe mode restrictions

2008-08-0720:00:00

RubySec

rubysec.com

12

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71,
and 1.9 through r18423 does not properly restrict access to critical
variables and methods at various safe levels, which allows context-dependent
attackers to bypass intended access restrictions via (1) untrace_var, (2)
$PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at
safe levels 1 through 3.

Affected configurations

Vulners

Node

rubyrubyRange1.8.6.286–1.8.7.0

OR

rubyrubyRange1.8.7.71–1.8.8.0

OR

rubyrubyRange<1.9.0

VendorProductVersionCPE
rubyruby*cpe:2.3:a:ruby:ruby:*:*:*:*:*:*:*:*

References

www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

Related for RUBY:RUBY-2008-3655

cvelist1 nvd1 prion1 exploitdb2 veracode1 ubuntucve1 cve1 nessus24 openvas43 redhat3 centos3 freebsd2 oraclelinux2 debian2 osv2 ubuntu1 suse1 gentoo1 fedora2 securityvulns1