ID

VAR-201103-0287

CVE

CVE-2011-0188

TITLE

Ruby of BigDecimal In class VpMemAlloc Vulnerability in arbitrary code execution in function

DESCRIPTION

The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue.". Ruby is prone to a remote code-execution vulnerability because it fails to properly sanitize user-supplied input. A successful exploit can allow an attacker to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition. Ruby 1.9.2 is vulnerable; other versions may also be affected. NOTE: This issue was previously described in BID 46950 (Apple Mac OS X Prior to 10.6.7 Multiple Security Vulnerabilities) but has been given its own record to better document it. Apple Mac OS X is a dedicated operating system developed by Apple for Mac computers. The safe-level feature in Ruby allows context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname (CVE-2011-1005). (CVE-2011-0188). The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team <security*mandriva.com> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFN2kOHmqjQ0CJFipgRAjT0AKCi4//MacXhajM4lSZ24BbA8dHPkwCgsYXk ieo0ut/wYOOUFl6E8bWk+gA= =S8F9 -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . (CVE-2011-1004) It was found that WEBrick (the Ruby HTTP server toolkit) did not filter terminal escape sequences from its log files. A remote attacker could use specially-crafted HTTP requests to inject terminal escape sequences into the WEBrick log files. If a victim viewed the log files with a terminal emulator, it could result in control characters being executed with the privileges of that user. (CVE-2009-4492) A cross-site scripting (XSS) flaw was found in the way WEBrick displayed error pages. A remote attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially-crafted URL. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: ruby security update Advisory ID: RHSA-2011:0910-01 Product: Red Hat Enterprise Linux Advisory URL: https://rhn.redhat.com/errata/RHSA-2011-0910.html Issue date: 2011-06-28 CVE Names: CVE-2011-0188 CVE-2011-1004 CVE-2011-1005 ===================================================================== 1. Summary: Updated ruby packages that fix three security issues are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux Desktop (v. 6) - i386, x86_64 Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, x86_64 Red Hat Enterprise Linux HPC Node Optional (v. 6) - x86_64 Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Server Optional (v. 6) - i386, ppc64, s390x, x86_64 Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64 Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, x86_64 3. Description: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. A flaw was found in the way large amounts of memory were allocated on 64-bit systems when using the BigDecimal class. This issue did not affect 32-bit systems. (CVE-2011-0188) A race condition flaw was found in the remove system entries method in the FileUtils module. If a local user ran a Ruby script that uses this method, a local attacker could use this flaw to delete arbitrary files and directories accessible to that user via a symbolic link attack. (CVE-2011-1004) A flaw was found in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2011-1005) Red Hat would like to thank Drew Yao of Apple Product Security for reporting the CVE-2011-0188 issue. All Ruby users should upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/kb/docs/DOC-11259 5. Bugs fixed (http://bugzilla.redhat.com/): 678913 - CVE-2011-1004 Ruby: Symlink race condition by removing directory trees in fileutils module 678920 - CVE-2011-1005 Ruby: Untrusted codes able to modify arbitrary strings 682332 - CVE-2011-0188 ruby: memory corruption in BigDecimal on 64bit platforms 6. Package List: Red Hat Enterprise Linux Desktop (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/ruby-1.8.7.299-7.el6_1.1.src.rpm i386: ruby-1.8.7.299-7.el6_1.1.i686.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-irb-1.8.7.299-7.el6_1.1.i686.rpm ruby-libs-1.8.7.299-7.el6_1.1.i686.rpm x86_64: ruby-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-irb-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-libs-1.8.7.299-7.el6_1.1.i686.rpm ruby-libs-1.8.7.299-7.el6_1.1.x86_64.rpm Red Hat Enterprise Linux Desktop Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Client/en/os/SRPMS/ruby-1.8.7.299-7.el6_1.1.src.rpm i386: ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-devel-1.8.7.299-7.el6_1.1.i686.rpm ruby-docs-1.8.7.299-7.el6_1.1.i686.rpm ruby-rdoc-1.8.7.299-7.el6_1.1.i686.rpm ruby-ri-1.8.7.299-7.el6_1.1.i686.rpm ruby-static-1.8.7.299-7.el6_1.1.i686.rpm ruby-tcltk-1.8.7.299-7.el6_1.1.i686.rpm x86_64: ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-devel-1.8.7.299-7.el6_1.1.i686.rpm ruby-devel-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-docs-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-rdoc-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-ri-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-static-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-tcltk-1.8.7.299-7.el6_1.1.x86_64.rpm Red Hat Enterprise Linux HPC Node Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6ComputeNode/en/os/SRPMS/ruby-1.8.7.299-7.el6_1.1.src.rpm x86_64: ruby-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-devel-1.8.7.299-7.el6_1.1.i686.rpm ruby-devel-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-docs-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-irb-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-libs-1.8.7.299-7.el6_1.1.i686.rpm ruby-libs-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-rdoc-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-ri-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-static-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-tcltk-1.8.7.299-7.el6_1.1.x86_64.rpm Red Hat Enterprise Linux Server (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/ruby-1.8.7.299-7.el6_1.1.src.rpm i386: ruby-1.8.7.299-7.el6_1.1.i686.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-irb-1.8.7.299-7.el6_1.1.i686.rpm ruby-libs-1.8.7.299-7.el6_1.1.i686.rpm ppc64: ruby-1.8.7.299-7.el6_1.1.ppc64.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.ppc.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.ppc64.rpm ruby-irb-1.8.7.299-7.el6_1.1.ppc64.rpm ruby-libs-1.8.7.299-7.el6_1.1.ppc.rpm ruby-libs-1.8.7.299-7.el6_1.1.ppc64.rpm s390x: ruby-1.8.7.299-7.el6_1.1.s390x.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.s390.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.s390x.rpm ruby-irb-1.8.7.299-7.el6_1.1.s390x.rpm ruby-libs-1.8.7.299-7.el6_1.1.s390.rpm ruby-libs-1.8.7.299-7.el6_1.1.s390x.rpm x86_64: ruby-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-irb-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-libs-1.8.7.299-7.el6_1.1.i686.rpm ruby-libs-1.8.7.299-7.el6_1.1.x86_64.rpm Red Hat Enterprise Linux Server Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Server/en/os/SRPMS/ruby-1.8.7.299-7.el6_1.1.src.rpm i386: ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-devel-1.8.7.299-7.el6_1.1.i686.rpm ruby-docs-1.8.7.299-7.el6_1.1.i686.rpm ruby-rdoc-1.8.7.299-7.el6_1.1.i686.rpm ruby-ri-1.8.7.299-7.el6_1.1.i686.rpm ruby-static-1.8.7.299-7.el6_1.1.i686.rpm ruby-tcltk-1.8.7.299-7.el6_1.1.i686.rpm ppc64: ruby-debuginfo-1.8.7.299-7.el6_1.1.ppc.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.ppc64.rpm ruby-devel-1.8.7.299-7.el6_1.1.ppc.rpm ruby-devel-1.8.7.299-7.el6_1.1.ppc64.rpm ruby-docs-1.8.7.299-7.el6_1.1.ppc64.rpm ruby-rdoc-1.8.7.299-7.el6_1.1.ppc64.rpm ruby-ri-1.8.7.299-7.el6_1.1.ppc64.rpm ruby-static-1.8.7.299-7.el6_1.1.ppc64.rpm ruby-tcltk-1.8.7.299-7.el6_1.1.ppc64.rpm s390x: ruby-debuginfo-1.8.7.299-7.el6_1.1.s390.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.s390x.rpm ruby-devel-1.8.7.299-7.el6_1.1.s390.rpm ruby-devel-1.8.7.299-7.el6_1.1.s390x.rpm ruby-docs-1.8.7.299-7.el6_1.1.s390x.rpm ruby-rdoc-1.8.7.299-7.el6_1.1.s390x.rpm ruby-ri-1.8.7.299-7.el6_1.1.s390x.rpm ruby-static-1.8.7.299-7.el6_1.1.s390x.rpm ruby-tcltk-1.8.7.299-7.el6_1.1.s390x.rpm x86_64: ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-devel-1.8.7.299-7.el6_1.1.i686.rpm ruby-devel-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-docs-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-rdoc-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-ri-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-static-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-tcltk-1.8.7.299-7.el6_1.1.x86_64.rpm Red Hat Enterprise Linux Workstation (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/ruby-1.8.7.299-7.el6_1.1.src.rpm i386: ruby-1.8.7.299-7.el6_1.1.i686.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-irb-1.8.7.299-7.el6_1.1.i686.rpm ruby-libs-1.8.7.299-7.el6_1.1.i686.rpm x86_64: ruby-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-irb-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-libs-1.8.7.299-7.el6_1.1.i686.rpm ruby-libs-1.8.7.299-7.el6_1.1.x86_64.rpm Red Hat Enterprise Linux Workstation Optional (v. 6): Source: ftp://ftp.redhat.com/pub/redhat/linux/enterprise/6Workstation/en/os/SRPMS/ruby-1.8.7.299-7.el6_1.1.src.rpm i386: ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-devel-1.8.7.299-7.el6_1.1.i686.rpm ruby-docs-1.8.7.299-7.el6_1.1.i686.rpm ruby-rdoc-1.8.7.299-7.el6_1.1.i686.rpm ruby-ri-1.8.7.299-7.el6_1.1.i686.rpm ruby-static-1.8.7.299-7.el6_1.1.i686.rpm ruby-tcltk-1.8.7.299-7.el6_1.1.i686.rpm x86_64: ruby-debuginfo-1.8.7.299-7.el6_1.1.i686.rpm ruby-debuginfo-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-devel-1.8.7.299-7.el6_1.1.i686.rpm ruby-devel-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-docs-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-rdoc-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-ri-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-static-1.8.7.299-7.el6_1.1.x86_64.rpm ruby-tcltk-1.8.7.299-7.el6_1.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://www.redhat.com/security/data/cve/CVE-2011-0188.html https://www.redhat.com/security/data/cve/CVE-2011-1004.html https://www.redhat.com/security/data/cve/CVE-2011-1005.html https://access.redhat.com/security/updates/classification/#moderate http://www.ruby-lang.org/en/news/2011/02/18/fileutils-is-vulnerable-to-symlink-race-attacks/ http://www.ruby-lang.org/en/news/2011/02/18/exception-methods-can-bypass-safe/ 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2011 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFOChFrXlSAg2UNWIIRAqVDAKC4AQkDB5prIP2m6NnD6qfX0sYGkACeOH7K 8UV4ULTNCtKEbwxTKay8Ilk= =Nsw7 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . ---------------------------------------------------------------------- http://twitter.com/secunia http://www.facebook.com/Secunia ---------------------------------------------------------------------- TITLE: Ruby BigDecimal Integer Truncation Vulnerability SECUNIA ADVISORY ID: SA44638 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/44638/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=44638 RELEASE DATE: 2011-05-25 DISCUSS ADVISORY: http://secunia.com/advisories/44638/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/44638/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=44638 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: A vulnerability has been reported in Ruby, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable system. The vulnerability is caused due to an integer truncation vulnerability within the "VpMemAlloc()" function in ext/bigdecimal/bigdecimal.c, which can be exploited to e.g. cause a memory corruption. SOLUTION: Fixed in the SVN repository. Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ PROVIDED AND/OR DISCOVERED BY: The vendor credits Drew Yao, Apple Product Security ORIGINAL ADVISORY: https://bugzilla.redhat.com/show_bug.cgi?id=682332 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=30993 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ---------------------------------------------------------------------- . Content-Disposition: inline ============================================================================ Ubuntu Security Notice USN-1377-1 February 28, 2012 ruby1.8 vulnerabilities ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.10 - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS Summary: Several security issues were fixed in ruby1.8. Software Description: - ruby1.8: Interpreter of object-oriented scripting language Ruby 1.8 Details: Drew Yao discovered that the WEBrick HTTP server was vulnerable to cross-site scripting attacks when displaying error pages. (CVE-2010-0541) Drew Yao discovered that Ruby's BigDecimal module did not properly allocate memory on 64-bit platforms. (CVE-2011-0188) Nicholas Jefferson discovered that the FileUtils.remove_entry_secure method in Ruby did not properly remove non-empty directories. (CVE-2011-1004) It was discovered that Ruby incorrectly allowed untainted strings to be modified in protective safe levels. (CVE-2011-1005) Eric Wong discovered that Ruby does not properly reseed its pseudorandom number generator when creating child processes. An attacker could use this flaw to gain knowledge of the random numbers used in other Ruby child processes. (CVE-2011-2686) Eric Wong discovered that the SecureRandom module in Ruby did not properly seed its pseudorandom number generator. An attacker could use this flaw to gain knowledge of the random numbers used by another Ruby process with the same process ID number. (CVE-2011-2705) Alexander Klink and Julian W=E4lde discovered that Ruby computed hash values without restricting the ability to trigger hash collisions predictably. A remote attacker could cause a denial of service by crafting values used in hash tables. (CVE-2011-4815) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.10: libruby1.8 1.8.7.352-2ubuntu0.1 ruby1.8 1.8.7.352-2ubuntu0.1 Ubuntu 11.04: libruby1.8 1.8.7.302-2ubuntu0.1 ruby1.8 1.8.7.302-2ubuntu0.1 Ubuntu 10.10: libruby1.8 1.8.7.299-2ubuntu0.1 ruby1.8 1.8.7.299-2ubuntu0.1 Ubuntu 10.04 LTS: libruby1.8 1.8.7.249-2ubuntu0.1 ruby1.8 1.8.7.249-2ubuntu0.1 In general, a standard system update will make all the necessary changes

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

remote

TYPE

other

CONFIGURATIONS

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Drew Yao

SOURCES

LAST UPDATE DATE

2025-08-15T22:54:41.979000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE