Ruby Version Manager Escape Sequence Command Injection Vulnerability
BID:45841
Info
Ruby Version Manager Escape Sequence Command Injection Vulnerability
| Bugtraq ID: | 45841 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-3928 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 18 2011 12:00AM |
| Updated: | Jan 18 2011 12:00AM |
| Credit: | JPCERT |
| Vulnerable: |
Ruby Version Manager Ruby Version Manager 1.2.0 |
| Not Vulnerable: |
Ruby Version Manager Ruby Version Manager 1.2.1 |
Discussion
Ruby Version Manager Escape Sequence Command Injection Vulnerability
Ruby Version Manager is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input.
Attackers can exploit this issue to execute arbitrary commands in a terminal.
Versions prior to Ruby Version Manager 1.2.1 is vulnerable.
Ruby Version Manager is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input.
Attackers can exploit this issue to execute arbitrary commands in a terminal.
Versions prior to Ruby Version Manager 1.2.1 is vulnerable.
Exploit / POC
Ruby Version Manager Escape Sequence Command Injection Vulnerability
To exploit this issue, an attacker must entice an unsuspecting victim into opening a malicious file.
To exploit this issue, an attacker must entice an unsuspecting victim into opening a malicious file.
Solution / Fix
Ruby Version Manager Escape Sequence Command Injection Vulnerability
Solution:
Updates are available. Please contact the vendor for more information.
Solution:
Updates are available. Please contact the vendor for more information.
References
Ruby Version Manager Escape Sequence Command Injection Vulnerability
References:
References:
- Ruby Version Manager Homepage (Ruby Version Manager)
- JVNDB-2011-000005 (JPCERT)