Ruby WEBrick UTF-7 Encoding Cross Site Scripting Vulnerability

Bugtraq ID:	40895
Class:	Input Validation Error
CVE:	CVE-2010-0541
Remote:	Yes
Local:	No
Published:	Jun 15 2010 12:00AM
Updated:	Apr 13 2015 09:38PM
Credit:	Apple
Vulnerable:	Yukihiro Matsumoto Ruby 1.9.3 dev Yukihiro Matsumoto Ruby 1.9.2 RC2 Yukihiro Matsumoto Ruby 1.9.2 -rc1 Yukihiro Matsumoto Ruby 1.9.1 -p429 Yukihiro Matsumoto Ruby 1.9.1 -p376 Yukihiro Matsumoto Ruby 1.9.1 Yukihiro Matsumoto Ruby 1.9 -2 Yukihiro Matsumoto Ruby 1.9 -1 Yukihiro Matsumoto Ruby 1.9 Yukihiro Matsumoto Ruby 1.8.7 -p72 Yukihiro Matsumoto Ruby 1.8.7 -p71 Yukihiro Matsumoto Ruby 1.8.7 -p22 Yukihiro Matsumoto Ruby 1.8.7 -p21 Yukihiro Matsumoto Ruby 1.8.7 Yukihiro Matsumoto Ruby 1.8.6 -p287 Yukihiro Matsumoto Ruby 1.8.6 -p286 Yukihiro Matsumoto Ruby 1.8.6 -p230 Yukihiro Matsumoto Ruby 1.8.6 -p229 Yukihiro Matsumoto Ruby 1.8.6 -p114 Yukihiro Matsumoto Ruby 1.8.6 Yukihiro Matsumoto Ruby 1.8.5 -p231 Yukihiro Matsumoto Ruby 1.8.5 -p230 Yukihiro Matsumoto Ruby 1.8.5 -p2 Yukihiro Matsumoto Ruby 1.8.5 -p115 Yukihiro Matsumoto Ruby 1.8.5 Yukihiro Matsumoto Ruby 1.8.4 Yukihiro Matsumoto Ruby 1.8.3 Yukihiro Matsumoto Ruby 1.8.2 pre4 + Gentoo Linux Yukihiro Matsumoto Ruby 1.8.2 pre3 + Gentoo Linux Yukihiro Matsumoto Ruby 1.8.2 pre2 Yukihiro Matsumoto Ruby 1.8.2 pre1 Yukihiro Matsumoto Ruby 1.8.2 Yukihiro Matsumoto Ruby 1.8.1 Yukihiro Matsumoto Ruby 1.8 + Redhat Fedora Core3 + Ubuntu Ubuntu Linux 5.0 4 powerpc + Ubuntu Ubuntu Linux 5.0 4 i386 + Ubuntu Ubuntu Linux 5.0 4 amd64 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 Yukihiro Matsumoto Ruby 1.6.8 Yukihiro Matsumoto Ruby 1.6.7 Yukihiro Matsumoto Ruby 1.6 Yukihiro Matsumoto Ruby 1.9.1-p378 Yukihiro Matsumoto Ruby 1.9.0-3 Yukihiro Matsumoto Ruby 1.9 Yukihiro Matsumoto Ruby 1.8.7-p299 Yukihiro Matsumoto Ruby 1.8.7-p249 Yukihiro Matsumoto Ruby 1.8.7-p248 Yukihiro Matsumoto Ruby 1.8.7-p173 Yukihiro Matsumoto Ruby 1.8.7-p160 Yukihiro Matsumoto Ruby 1.8.6-p399 Yukihiro Matsumoto Ruby 1.8.6-p388 Yukihiro Matsumoto Ruby 1.8.6-p383 Yukihiro Matsumoto Ruby 1.8.6-p369 Yukihiro Matsumoto Ruby 1.8.6-p368 Yukihiro Matsumoto Ruby 0 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux Long Life 5.6 server Redhat Enterprise Linux EUS 5.6.z server Redhat Enterprise Linux ES 4.8.z Redhat Enterprise Linux ES 4 Redhat Enterprise Linux Desktop 5 client Redhat Enterprise Linux AS 4.8.z Redhat Enterprise Linux AS 4 Redhat Enterprise Linux 5 Server Redhat Desktop Workstation 5 Redhat Desktop 4.0 Pardus Linux 2009 0 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Avaya Aura System Manager 6.3.1 Avaya Aura System Manager 6.3 Avaya Aura System Manager 6.2.3 Avaya Aura System Manager 6.2 Avaya Aura System Manager 6.1.5 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.6 Apple Mac OS X 10.5
Not Vulnerable:	Yukihiro Matsumoto Ruby 1.9.1-p430 Yukihiro Matsumoto Ruby 1.8.7-p302 Avaya Aura System Manager 6.3.2 Apple Mac OS X Server 10.6.4 Apple Mac OS X 10.6.4

Ruby WEBrick UTF-7 Encoding Cross Site Scripting Vulnerability

Ruby WEBrick is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

NOTE: This issue was previously covered in BID 40871 (Apple Mac OS X Prior to 10.6.4 Multiple Security Vulnerabilities), but has been given its own record to better document it.

Ruby WEBrick UTF-7 Encoding Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Ruby WEBrick UTF-7 Encoding Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references for details.


Yukihiro Matsumoto Ruby 1.8.7-p173

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.7-p299

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.9.1-p378

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.6-p368

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Apple Mac OS X Server 10.6

• Apple MacOSXServUpdCombo10.6.4.dmg
  http://www.apple.com/support/downloads/

Yukihiro Matsumoto Ruby 1.8.6-p369

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva ruby-1.8.7.p249-4.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-devel-1.8.7.p249-4.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-doc-1.8.7.p249-4.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-tk-1.8.7.p249-4.1mdv2010.2.x86_64.rpm
  http://www.mandriva.com/en/download/

Yukihiro Matsumoto Ruby 1.8.7-p248

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.4.dmg
  http://www.apple.com/support/downloads/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva ruby-1.8.7-7p72.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-devel-1.8.7-7p72.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-doc-1.8.7-7p72.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-tk-1.8.7-7p72.4mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Yukihiro Matsumoto Ruby 1.8.7-p249

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.6-p383

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.6-p399

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva ruby-1.8.7-7p72.4mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-devel-1.8.7-7p72.4mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-doc-1.8.7-7p72.4mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-tk-1.8.7-7p72.4mdvmes5.2.x86_64.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Enterprise Server 5

• Mandriva ruby-1.8.7-7p72.4mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-devel-1.8.7-7p72.4mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-doc-1.8.7-7p72.4mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva ruby-tk-1.8.7-7p72.4mdvmes5.2.i586.rpm
  http://www.mandriva.com/en/download/

Yukihiro Matsumoto Ruby 1.8.6

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.6 -p230

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.6 -p287

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.6 -p114

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.7

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.7 -p22

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.7 -p21

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.7 -p71

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.8.7 -p72

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.9.1 -p376

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.9.1 -p429

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.9.1

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Yukihiro Matsumoto Ruby 1.9.3 dev

• Yukihiro Matsumoto webrick-cve-2010-0541.diff
  ftp://ftp.ruby-lang.org/pub/misc/webrick-cve-2010-0541.diff

Apple Mac OS X Server 10.6.1

• Apple MacOSXServUpdCombo10.6.4.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.1

• Apple MacOSXUpdCombo10.6.4.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.2

• Apple MacOSXServUpdCombo10.6.4.dmg
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.3

• Apple MacOSXUpd10.6.4.dmg
  http://www.apple.com/support/downloads/

Ruby WEBrick UTF-7 Encoding Cross Site Scripting Vulnerability

References:

• Mac OS X Homepage (Apple)
  
• XSS in WEBrick (CVE-2010-0541) (Yukihiro Matsumoto)
  
• ASA-2011-199 ruby security update (RHSA-2011-0909) (Avaya)
  
• ASA-2011-199: ruby security update (RHSA-2011-0909) (Avaya)
  
• RHSA-2011:0908 ruby security update (Red Hat)
  
• RHSA-2011:0909 ruby security update (Red Hat)