Ruby 'rb_str_justify()' Heap Based Buffer Overflow Vulnerability

Bugtraq ID:	37278
Class:	Boundary Condition Error
CVE:	CVE-2009-4124
Remote:	Yes
Local:	Yes
Published:	Dec 07 2009 12:00AM
Updated:	Feb 16 2010 06:51PM
Credit:	Emmanouel Kellinis, KPMG London
Vulnerable:	Yukihiro Matsumoto Ruby 1.9.1 Ubuntu Ubuntu Linux 9.10 sparc Ubuntu Ubuntu Linux 9.10 powerpc Ubuntu Ubuntu Linux 9.10 lpia Ubuntu Ubuntu Linux 9.10 i386 Ubuntu Ubuntu Linux 9.10 amd64 Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64
Not Vulnerable:	Yukihiro Matsumoto Ruby 1.9.1 -p376

Ruby 'rb_str_justify()' Heap Based Buffer Overflow Vulnerability

Ruby is prone to a buffer-overflow vulnerability because it fails to properly sanitize user-supplied data.

Successful exploits may allow attackers to run arbitrary code in the context of applications implemented with Ruby. Failed exploit attempts may result in denial-of-service conditions.

The issue affects Ruby 1.9.1 (prior to 1.9.1-p376).

Ruby 'rb_str_justify()' Heap Based Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Ruby 'rb_str_justify()' Heap Based Buffer Overflow Vulnerability

Solution:
The vendor has released updates. Please see the references for details.


Yukihiro Matsumoto Ruby 1.9.1

• Yukihiro Matsumoto ruby-1.9.1-p376.tar.bz2
  ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.1-p376.tar.bz2

Ruby 'rb_str_justify()' Heap Based Buffer Overflow Vulnerability

References:

• Ruby Homepage (Yukihiro Matsumoto)
  
• Heap overflow in String (Yukihiro Matsumoto)