Ruby WEBrick Remote Directory Traversal and Information Disclosure Vulnerabilities
BID:28123
Info
Ruby WEBrick Remote Directory Traversal and Information Disclosure Vulnerabilities
| Bugtraq ID: | 28123 |
| Class: | Unknown |
| CVE: |
CVE-2008-1145 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 06 2008 12:00AM |
| Updated: | Mar 19 2015 08:29AM |
| Credit: | Alexandr Polyakov and Stas Svistunovich of Digital Security Research Group reported these issues to the vendor. |
| Vulnerable: |
Yukihiro Matsumoto Ruby 1.9 Yukihiro Matsumoto Ruby 1.8.6 Yukihiro Matsumoto Ruby 1.8.5 -p2 Yukihiro Matsumoto Ruby 1.8.5 Yukihiro Matsumoto Ruby 1.8.4 Yukihiro Matsumoto Ruby 1.8.3 Yukihiro Matsumoto Ruby 1.8.2 pre4 Yukihiro Matsumoto Ruby 1.8.2 pre3 Yukihiro Matsumoto Ruby 1.8.2 pre2 Yukihiro Matsumoto Ruby 1.8.2 pre1 Yukihiro Matsumoto Ruby 1.8.2 Yukihiro Matsumoto Ruby 1.8.1 Yukihiro Matsumoto Ruby 1.8 Yukihiro Matsumoto Ruby 1.6.8 Yukihiro Matsumoto Ruby 1.6.7 Yukihiro Matsumoto Ruby 1.6 SuSE SUSE Linux Enterprise Server 9 SP3 SuSE SUSE Linux Enterprise Server 10 SP2 SuSE SUSE Linux Enterprise Server 10 SP1 SuSE SUSE Linux Enterprise Server 10 SuSE SUSE Linux Enterprise Desktop 10 SP2 SuSE SUSE Linux Enterprise Desktop 10 SP1 SuSE SUSE Linux Enterprise Desktop 10 SuSE openSUSE 10.3 SuSE Linux Professional 10.2 x86_64 SuSE Linux Personal 10.2 x86_64 S.u.S.E. SuSE Linux Standard Server 8.0 S.u.S.E. SUSE LINUX Retail Solution 8.0 S.u.S.E. SuSE Linux Openexchange Server 4.0 S.u.S.E. SuSE Linux Open-Xchange 4.1 S.u.S.E. openSUSE 11.0 S.u.S.E. openSUSE 10.2 S.u.S.E. Novell Linux Desktop 9.0 S.u.S.E. Linux Professional 10.2 S.u.S.E. Linux Professional 10.1 S.u.S.E. Linux Personal 10.2 S.u.S.E. Linux Personal 10.1 S.u.S.E. Linux Enterprise Server for S/390 9.0 S.u.S.E. Linux Enterprise Server for S/390 S.u.S.E. Linux Desktop 10 S.u.S.E. Linux 10.1 x86-64 S.u.S.E. Linux 10.1 x86 S.u.S.E. Linux 10.1 ppc rPath rPath Linux 1 rPath Appliance Platform Linux Service 1 Red Hat Fedora 8 Red Hat Fedora 7 Metasploit Project Metasploit Framework 3.1 Metasploit Project Metasploit Framework 3.0 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 Mandriva Linux Mandrake 2007.1 x86_64 Mandriva Linux Mandrake 2007.1 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.5 |
| Not Vulnerable: |
Yukihiro Matsumoto Ruby 1.9 -1 Yukihiro Matsumoto Ruby 1.8.6 -p114 Yukihiro Matsumoto Ruby 1.8.5 -p115 Apple Mac OS X Server 10.5.4 Apple Mac OS X 10.5.4 |
Discussion
Ruby WEBrick Remote Directory Traversal and Information Disclosure Vulnerabilities
Ruby's WEBrick server is prone to remote directory-traversal and information-disclosure vulnerabilities.
Successfully exploiting these issues allows remote attackers to access the contents of arbitrary files. Information harvested may aid in further attacks.
These issues affect only operating systems that allow backslash (\) characters as path separators and operating systems that use case-insensitive filenames. This exposes Microsoft Windows and Apple Mac OS X operating systems to attack.
Ruby's WEBrick server is prone to remote directory-traversal and information-disclosure vulnerabilities.
Successfully exploiting these issues allows remote attackers to access the contents of arbitrary files. Information harvested may aid in further attacks.
These issues affect only operating systems that allow backslash (\) characters as path separators and operating systems that use case-insensitive filenames. This exposes Microsoft Windows and Apple Mac OS X operating systems to attack.
Exploit / POC
Ruby WEBrick Remote Directory Traversal and Information Disclosure Vulnerabilities
The following proof-of-concept URI is available for the directory-traversal vulnerability:
http://www.example.com/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/boot.ini
The following proof-of-concept URI is available for the directory-traversal vulnerability:
http://www.example.com/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/boot.ini
Solution / Fix
Ruby WEBrick Remote Directory Traversal and Information Disclosure Vulnerabilities
Solution:
The vendor has released fixes to address these issues. Please see the references for more information.
Yukihiro Matsumoto Ruby 1.8.5 -p2
Yukihiro Matsumoto Ruby 1.8.6
Yukihiro Matsumoto Ruby 1.9
Solution:
The vendor has released fixes to address these issues. Please see the references for more information.
Yukihiro Matsumoto Ruby 1.8.5 -p2
-
Yukihiro Matsumoto ruby-1.8.5-p115.tar.gz
ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p115.tar.gz
Yukihiro Matsumoto Ruby 1.8.6
-
Yukihiro Matsumoto ruby-1.8.6-p114.tar.gz
ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p114.tar.gz
Yukihiro Matsumoto Ruby 1.9
-
Yukihiro Matsumoto ruby-1.9.0-1-webrick-vulnerability-fix.diff
ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.0-1-webrick-vulnerabilit y-fix.diff
References
Ruby WEBrick Remote Directory Traversal and Information Disclosure Vulnerabilities
References:
References:
- About the security content of Security Update 2008-004 and Mac OS X 10.5.4 (Apple)
- Ruby Homepage (Yukihiro Matsumoto)
- [DSECRG-08-018] Ruby 1.8.6 (Webrick Httpd 1.3.1) Directory traversal file Down (Alexandr Polyakov
- Re: [DSECRG-08-018] Ruby 1.8.6 (Webrick Httpd 1.3.1) Directory traversal file (H D Moore
- File access vulnerability of WEBrick (Ruby)
- Vulnerability Note VU#404515 Ruby WEBrick vulnerable to directory traversal (US-CERT)