JRuby Insecure Library Loading Arbitrary Code Execution Vulnerability

Bugtraq ID:	60918
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 22 2010 12:00AM
Updated:	Dec 22 2010 12:00AM
Credit:	Charles Oliver Nutter
Vulnerable:	JRuby JRuby 1.6
Not Vulnerable:	JRuby JRuby 1.6.4

JRuby Insecure Library Loading Arbitrary Code Execution Vulnerability

JRuby is prone to a vulnerability that lets attackers execute arbitrary code.

Attacker can leverage this issue to execute arbitrary code in the context of the user running the affected application.

JRuby 1.6 is vulnerable; other versions may also be affected.

JRuby Insecure Library Loading Arbitrary Code Execution Vulnerability

Attackers can use standard, readily available tools to exploit this issue.

JRuby Insecure Library Loading Arbitrary Code Execution Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

JRuby Insecure Library Loading Arbitrary Code Execution Vulnerability

References:

• Getting Started with JRuby (JRuby)
  
• The dir should not be in load path, but we also put it in CLASSPATH (JRuby)