Ruby 'BigDecimal' Class Integer Truncation Remote Code Execution Vulnerability
BID:46966
Info
Ruby 'BigDecimal' Class Integer Truncation Remote Code Execution Vulnerability
| Bugtraq ID: | 46966 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2011-0188 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 21 2011 12:00AM |
| Updated: | Mar 19 2015 08:18AM |
| Credit: | Drew Yao |
| Vulnerable: |
Yukihiro Matsumoto Ruby 1.9.2 RC2 Yukihiro Matsumoto Ruby 1.9.2 P180 Yukihiro Matsumoto Ruby 1.9.2 P136 Yukihiro Matsumoto Ruby 1.9.2 P0 Yukihiro Matsumoto Ruby 1.9.2 -rc1 Yukihiro Matsumoto Ruby 1.9.1 P431 Yukihiro Matsumoto Ruby 1.9.1 -p429 Yukihiro Matsumoto Ruby 1.9.1 -p376 Yukihiro Matsumoto Ruby 1.9.1 Yukihiro Matsumoto Ruby 1.9 -2 Yukihiro Matsumoto Ruby 1.9 -1 Yukihiro Matsumoto Ruby 1.9 Yukihiro Matsumoto Ruby 1.8.7 -p72 Yukihiro Matsumoto Ruby 1.8.7 -p71 Yukihiro Matsumoto Ruby 1.8.7 -p22 Yukihiro Matsumoto Ruby 1.8.7 -p21 Yukihiro Matsumoto Ruby 1.8.7 Yukihiro Matsumoto Ruby 1.8.6 -p287 Yukihiro Matsumoto Ruby 1.8.6 -p286 Yukihiro Matsumoto Ruby 1.8.6 -p230 Yukihiro Matsumoto Ruby 1.8.6 -p229 Yukihiro Matsumoto Ruby 1.8.6 -p114 Yukihiro Matsumoto Ruby 1.8.6 Yukihiro Matsumoto Ruby 1.8.5 -p231 Yukihiro Matsumoto Ruby 1.8.5 -p230 Yukihiro Matsumoto Ruby 1.8.5 -p2 Yukihiro Matsumoto Ruby 1.8.5 -p115 Yukihiro Matsumoto Ruby 1.8.5 Yukihiro Matsumoto Ruby 1.8.4 Yukihiro Matsumoto Ruby 1.8.3 Yukihiro Matsumoto Ruby 1.8.2 pre4 Yukihiro Matsumoto Ruby 1.8.2 pre3 Yukihiro Matsumoto Ruby 1.8.2 pre2 Yukihiro Matsumoto Ruby 1.8.2 pre1 Yukihiro Matsumoto Ruby 1.8.2 Yukihiro Matsumoto Ruby 1.8.1 Yukihiro Matsumoto Ruby 1.8 Yukihiro Matsumoto Ruby 1.6.8 Yukihiro Matsumoto Ruby 1.6.7 Yukihiro Matsumoto Ruby 1.6 Yukihiro Matsumoto Ruby 1.9.2 pre3 Yukihiro Matsumoto Ruby 1.9.1-p430 Yukihiro Matsumoto Ruby 1.9.1-p378 Yukihiro Matsumoto Ruby 1.9.0-3 Yukihiro Matsumoto Ruby 1.9 Yukihiro Matsumoto Ruby 1.8.7-p334 Yukihiro Matsumoto Ruby 1.8.7-p330 Yukihiro Matsumoto Ruby 1.8.7-p302 Yukihiro Matsumoto Ruby 1.8.7-p299 Yukihiro Matsumoto Ruby 1.8.7-p249 Yukihiro Matsumoto Ruby 1.8.7-p248 Yukihiro Matsumoto Ruby 1.8.7-p173 Yukihiro Matsumoto Ruby 1.8.7-p160 Yukihiro Matsumoto Ruby 1.8.6-p420 Yukihiro Matsumoto Ruby 1.8.6-p399 Yukihiro Matsumoto Ruby 1.8.6-p388 Yukihiro Matsumoto Ruby 1.8.6-p383 Yukihiro Matsumoto Ruby 1.8.6-p369 Yukihiro Matsumoto Ruby 1.8.6-p368 Yukihiro Matsumoto Ruby 0 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.10 powerpc Ubuntu Ubuntu Linux 10.10 i386 Ubuntu Ubuntu Linux 10.10 ARM Ubuntu Ubuntu Linux 10.10 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4.8.z RedHat Enterprise Linux ES 4 RedHat Desktop 4.0 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server EUS 6.1.z Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux Long Life 5.6 server Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux EUS 5.6.z server Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4.8.z Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux 5 Server Red Hat Desktop Workstation 5 Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 4.0 Gentoo Linux Avaya Aura System Manager 6.2 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 Apple Mac OS X Server 10.6.6 Apple Mac OS X Server 10.6.5 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5 Apple Mac OS X 10.6.5 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5 Apple Mac OS X 10.6 Apple Mac OS X 10.5 |
| Not Vulnerable: |
Apple Mac Os X Server 10.6.7 |
Discussion
Ruby 'BigDecimal' Class Integer Truncation Remote Code Execution Vulnerability
Ruby is prone to a remote code-execution vulnerability because it fails to properly sanitize user-supplied input.
A successful exploit can allow an attacker to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Ruby 1.9.2 is vulnerable; other versions may also be affected.
NOTE: This issue was previously described in BID 46950 (Apple Mac OS X Prior to 10.6.7 Multiple Security Vulnerabilities) but has been given its own record to better document it.
Ruby is prone to a remote code-execution vulnerability because it fails to properly sanitize user-supplied input.
A successful exploit can allow an attacker to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.
Ruby 1.9.2 is vulnerable; other versions may also be affected.
NOTE: This issue was previously described in BID 46950 (Apple Mac OS X Prior to 10.6.7 Multiple Security Vulnerabilities) but has been given its own record to better document it.
Exploit / POC
Ruby 'BigDecimal' Class Integer Truncation Remote Code Execution Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Ruby 'BigDecimal' Class Integer Truncation Remote Code Execution Vulnerability
Solution:
Vendor updates are available. Please see the references for more information.
Apple Mac OS X 10.6
Mandriva Linux Mandrake 2009.0 x86_64
MandrakeSoft Enterprise Server 5
Mandriva Linux Mandrake 2009.0
Apple Mac OS X Server 10.6
Apple Mac OS X 10.5.8
Apple Mac OS X 10.6.1
Apple Mac OS X 10.6.3
Apple Mac OS X 10.6.4
Apple Mac OS X Server 10.6.4
Apple Mac OS X Server 10.6.6
MandrakeSoft Corporate Server 4.0 x86_64
Solution:
Vendor updates are available. Please see the references for more information.
Apple Mac OS X 10.6
-
Apple MacOSXUpdCombo10.6.7.dmg
For Mac OS X v10.6 - v10.6.5
http://www.apple.com/support/downloads/
Mandriva Linux Mandrake 2009.0 x86_64
-
Mandriva ruby-1.8.7-7p72.4mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-devel-1.8.7-7p72.4mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-doc-1.8.7-7p72.4mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-tk-1.8.7-7p72.4mdv2009.0.x86_64.rpm
http://www.mandriva.com/en/download/
MandrakeSoft Enterprise Server 5
-
Mandriva ruby-1.8.7-7p72.4mdvmes5.2.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-devel-1.8.7-7p72.4mdvmes5.2.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-doc-1.8.7-7p72.4mdvmes5.2.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-tk-1.8.7-7p72.4mdvmes5.2.i586.rpm
http://www.mandriva.com/en/download/
Mandriva Linux Mandrake 2009.0
-
Mandriva ruby-1.8.7-7p72.4mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-devel-1.8.7-7p72.4mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-doc-1.8.7-7p72.4mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-tk-1.8.7-7p72.4mdv2009.0.i586.rpm
http://www.mandriva.com/en/download/
Apple Mac OS X Server 10.6
-
Apple MacOSXServerUpdCombo10.6.7.dmg
For Mac OS X Server v10.6 - v10.6.5
http://www.apple.com/support/downloads/
Apple Mac OS X 10.5.8
-
Apple SecUpd2011-001.dmg
For Mac OS X v10.5.8
http://www.apple.com/support/downloads/
Apple Mac OS X 10.6.1
-
Apple MacOSXUpdCombo10.6.7.dmg
For Mac OS X v10.6 - v10.6.5
http://www.apple.com/support/downloads/
Apple Mac OS X 10.6.3
-
Apple MacOSXUpdCombo10.6.7.dmg
For Mac OS X v10.6 - v10.6.5
http://www.apple.com/support/downloads/
Apple Mac OS X 10.6.4
-
Apple MacOSXUpdCombo10.6.7.dmg
For Mac OS X v10.6 - v10.6.5
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.6.4
-
Apple MacOSXServerUpdCombo10.6.7.dmg
For Mac OS X Server v10.6 - v10.6.5
http://www.apple.com/support/downloads/
Apple Mac OS X Server 10.6.6
-
Apple MacOSXServerUpd10.6.7.dmg
For Mac OS X Server v10.6.6
http://www.apple.com/support/downloads/
MandrakeSoft Corporate Server 4.0 x86_64
-
Mandriva ruby-1.8.2-7.12.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-devel-1.8.2-7.12.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-doc-1.8.2-7.12.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/ -
Mandriva ruby-tk-1.8.2-7.12.20060mlcs4.x86_64.rpm
http://www.mandriva.com/en/download/
References
Ruby 'BigDecimal' Class Integer Truncation Remote Code Execution Vulnerability
References:
References:
- Mac OS X Homepage (Apple)
- Revision 30993 (Ruby)
- Ruby Homepage (Ruby)
- ASA-2011-199 ruby security update (RHSA-2011-0909) (Avaya)
- RHSA-2011:0908 ruby security update (Red Hat)
- RHSA-2011:0909 ruby security update (Red Hat)
- RHSA-2011:0910 ruby security update (Red Hat)