CVSS: 7.5EPSS: 39%CPEs: 47EXPL: 4CVE-2008-3655 – Ruby 1.9 - Safe Level Multiple Function Restriction Bypass
https://notcve.org/view.php?id=CVE-2008-3655
Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3. Ruby versiones 1.8.5 y anteriores, versiones 1.8.6 hasta 1.8.6-p286, versiones 1.8.7 hasta 1.8.7-p71, y versiones 1.9 hasta r18423, no restringe apropiadamente el acceso a variables y métodos críticos en varios niveles seguros, lo que permite a los atacantes dependiendo del contexto omitir las restricciones de acceso previstas por medio de (1) untrace_var, (2) $PROGRAM_NAME, y (3) syslog en nivel seguro 4 y (4) métodos no confiables en los niveles seguros 1 a 3. • https://www.exploit-db.com/exploits/32224 https://www.exploit-db.com/exploits/32223 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://secunia.com/advisories/31430 http://secunia.com/advisories/31697 http://secunia.com/advisories/32165 http://secunia.com/advisories/32219 http://secunia.com/advisories/32255 http://secunia.com/advisories/32256 http://secunia.com/advisories/32371 http:// • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 10%CPEs: 43EXPL: 2CVE-2008-3656 – Ruby 1.9 - 'WEBrick::HTTP::DefaultFileHandler' Crafted HTTP Request Denial of Service
https://notcve.org/view.php?id=CVE-2008-3656
Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression. Una vulnerabilidad de complejidad algorítmica en la función WEBrick::HTTPUtils.split_header_value en WEBrick::HTTP::DefaultFileHandler en WEBrick en Ruby versiones 1.8.5 y anteriores, versiones 1.8.6 hasta 1.8.6-p286, versiones 1.8.7 hasta 1.8.7-p71, y versiones 1.9 hasta r18423, permite a los atacantes dependiendo del contexto causar una denegación de servicio (consumo de CPU) por medio de una petición HTTP diseñada que se procesa mediante una expresión regular backtracking. The WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 to 1.8.6-p286, 1.8.7 to 1.8.7-p71, and 1.9 to r18423 allows for a DoS (CPU consumption) via a crafted HTTP request. • https://www.exploit-db.com/exploits/32222 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://secunia.com/advisories/31430 http://secunia.com/advisories/31697 http://secunia.com/advisories/32165 http://secunia.com/advisories/32219 http://secunia.com/advisories/32255 http://secunia.com/advisories/32256 http://secunia.com/advisories/32371 http://secunia.com/advisories/33178 http://secunia.c • CWE-399: Resource Management Errors •
CVSS: 7.5EPSS: 5%CPEs: 43EXPL: 2CVE-2008-3657 – Ruby 1.9 dl - Module DL.dlopen Arbitrary Library Access
https://notcve.org/view.php?id=CVE-2008-3657
The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen. El módulo dl en Ruby versiones 1.8.5 y anteriores, versiones 1.8.6 hasta 1.8.6-p286, versiones 1.8.7 hasta 1.8.7-p71, y versiones 1.9 a r18423 no comprueba la "taintness" de entradas, lo que permite a los atacantes dependiendo del contexto omitir los niveles seguros y ejecutar funciones peligrosas mediante el acceso a una biblioteca usando DL.dlopen. • https://www.exploit-db.com/exploits/32223 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401 http://lists.apple.com/archives/security-announce/2009/May/msg00002.html http://secunia.com/advisories/31430 http://secunia.com/advisories/31697 http://secunia.com/advisories/32165 http://secunia.com/advisories/32219 http://secunia.com/advisories/32255 http://secunia.com/advisories/32256 http://secunia.com/advisories/32371 http://secunia.com/advisories/33178 http://secunia.c • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 0CVE-2008-2664 – ruby: Unsafe use of alloca in rb_str_format()
https://notcve.org/view.php?id=CVE-2008-2664
The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change. La función rb_str_format en Ruby 1.8.4 y anteriores, 1.8.5 anterior a 1.8.5-p231, 1.8.6 anterior a 1.8.6-p230, 1.8.7 anterior a 1.8.7-p22 y 1.9.0 anterior a 1.9.0-2 permite a atacantes dependientes del contexto disparar una corrupción de memoria mediante vectores no especificados relacionados con alloca, un problema distinto a CVE-2008-2662, CVE-2008-2663 y CVE-2008-2725. NOTA: a fecha de 24-06-2008, ha habido un uso inconsistente de múltiples identificadores CVE relacionados con Ruby. • http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html http://secunia.com/advisories/30802 http://secunia.com/advisories/30831 http://secunia.com/advisories/30867 http://secunia.com/advisories/30875 http://secunia.com/advisories/30894 http://secunia.com/advisories/31062 http://secunia • CWE-399: Resource Management Errors •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2008-2725 – ruby: integer overflow in rb_ary_splice/update/replace() - REALLOC_N
https://notcve.org/view.php?id=CVE-2008-2725
Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption via unspecified vectors, aka the "REALLOC_N" variant, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2664. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change. Un desbordamiento de enteros en la función (1) rb_ary_splice en Ruby 1.8.4 y versiones anteriores, 1.8.5 anterior a versión 1.8.5-p231, 1.8.6 anterior a versión 1.8.6-p230 y 1.8.7 anterior a versión 1.8.7-p22; y (2) la función rb_ary_replace en 1.6.x permite a los atacantes dependiendo del contexto desencadenar una corrupción en la memoria por medio de vectores no especificados, también se conoce como la variante "REALLOC_N", un problema diferente a los CVE-2008-2662, CVE-2008-2663 y CVE-2008-2664. NOTA: a partir de 20080624, ha habido un uso incoherente de varios identificadores CVE relacionados con Ruby. • http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue http://lists.apple.com/archives/security-announce/2008//Jun/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html http://secunia.com/advisories/30802 http://secunia.com/advisories/30831 http://secunia.com/advisories/30867 http://secunia.com/advisories/30875 http://secunia.com/advisories/30894 http://secunia.com/advisories/31062 http://secunia • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •