Multiple RubyGems CVE-2014-4993 Local Information Disclosure Vulnerability

Bugtraq ID:	68732
Class:	Design Error
CVE:	CVE-2014-4993
Remote:	No
Local:	Yes
Published:	Jun 01 2014 12:00AM
Updated:	Jun 01 2014 12:00AM
Credit:	Larry W. Cashdollar
Vulnerable:	Lukasz Kaniowski backup_checksum 3.0.23 Anthony Goddard backup-agoddard 3.0.28
Not Vulnerable:

Multiple RubyGems CVE-2014-4993 Local Information Disclosure Vulnerability

Multiple RubyGems are prone to a local information-disclosure vulnerability.

Local attackers may exploit this issue to obtain sensitive information, such as password, that may aid in further attacks.

The following product versions are affected:

backup-agoddard version 3.0.28
backup_checksum version 3.0.23

Multiple RubyGems CVE-2014-4993 Local Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Multiple RubyGems CVE-2014-4993 Local Information Disclosure Vulnerability

References:

• backup-agoddard Product Page (Anthony Goddard)
  
• backup_checksum Product Page (Lukasz Kaniowski)
  
• Re: Vulnerability Report for Ruby Gem codders-dataset-1.3.2.1 (etc.) (oss-sec)
  
• Title: Vulnerability Report for Ruby Gem backup-agoddard-3.0.28 (Larry W. Cashdollar)
  
• Title: Vulnerability Report for Ruby Gem backup_checksum-3.0.23 (Larry W. Cashdollar)