RubyGems 'ldoce' CVE-2013-1911 Remote Command Execution Vulnerability

Bugtraq ID:	58783
Class:	Input Validation Error
CVE:	CVE-2013-1911
Remote:	Yes
Local:	No
Published:	Mar 31 2013 12:00AM
Updated:	Mar 31 2013 12:00AM
Credit:	Larry W. Cashdollar
Vulnerable:	RubyGems ldoce 0.0.2
Not Vulnerable:

RubyGems 'ldoce' CVE-2013-1911 Remote Command Execution Vulnerability

ldoce is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input.

Successful exploits may allow an attacker to execute arbitrary commands in the context of the affected application.

ldoce 0.0.2 is vulnerable; other versions may also be affected.

RubyGems 'ldoce' CVE-2013-1911 Remote Command Execution Vulnerability

The following example data is available:

• /data/vulnerabilities/exploits/58783.rb

RubyGems 'ldoce' CVE-2013-1911 Remote Command Execution Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

RubyGems 'ldoce' CVE-2013-1911 Remote Command Execution Vulnerability

References:

• ldoce Homepage (RubyGems)
  
• Remote command execution in Ruby Gem ldoce 0.0.2 (Larry W. Cashdollar)