// For flags

CVE-2008-2663

ruby: Integer overflows in rb_ary_store()

Severity Score

10.0
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors, a different issue than CVE-2008-2662, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

Múltiples desbordamientos de entero en la función rb_ary_store de Ruby 1.8.4 y anteriores, 1.8.5 anterior a 1.8.5-p231, 1.8.6 anterior a 1.8.6-p230 y 1.8.7 anterior a 1.8.7-p22 permite a atacantes dependientes del contexto ejecutar código de su elección mediante vectores desconocidos, un problema distinto a CVE-2008-2662, CVE-2008-2664 y CVE-2008-2725. NOTA: a fecha de 24-06-2008, ha habido un uso inconsistente de múltiples identificadores CVE relacionados con Ruby. La descripción CVE debe tomarse como autorizada aunque probablemente cambie.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2008-06-10 CVE Reserved
  • 2008-06-24 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-07 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-190: Integer Overflow or Wraparound
CAPEC
References (42)
URL Tag Source
http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue Third Party Advisory
http://secunia.com/advisories/30802 Third Party Advisory
http://secunia.com/advisories/30831 Third Party Advisory
http://secunia.com/advisories/30867 Third Party Advisory
http://secunia.com/advisories/30875 Third Party Advisory
http://secunia.com/advisories/30894 Third Party Advisory
http://secunia.com/advisories/31062 Third Party Advisory
http://secunia.com/advisories/31090 Third Party Advisory
http://secunia.com/advisories/31181 Third Party Advisory
http://secunia.com/advisories/31256 Third Party Advisory
http://secunia.com/advisories/31687 Third Party Advisory
http://secunia.com/advisories/33178 Third Party Advisory
http://support.apple.com/kb/HT2163 Third Party Advisory
http://weblog.rubyonrails.org/2008/6/21/multiple-ruby-security-vulnerabilities Third Party Advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0206 Broken Link
http://www.matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities Third Party Advisory
http://www.ruby-forum.com/topic/157034 Third Party Advisory
http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.html Third Party Advisory
http://www.securityfocus.com/archive/1/493688/100/0/threaded Mailing List
http://www.securityfocus.com/bid/29903 Third Party Advisory
http://www.securitytracker.com/id?1020347 Third Party Advisory
http://www.vupen.com/english/advisories/2008/1907/references Third Party Advisory
http://www.vupen.com/english/advisories/2008/1981/references Third Party Advisory
http://www.zedshaw.com/rants/the_big_ruby_vulnerabilities.html Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/43346 Third Party Advisory
https://issues.rpath.com/browse/RPL-2626 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10524 Signature
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Ruby-lang
Search vendor "Ruby-lang"
Ruby
Search vendor "Ruby-lang" for product "Ruby"
<= 1.8.4
Search vendor "Ruby-lang" for product "Ruby" and version " <= 1.8.4"
-
Affected
Ruby-lang
Search vendor "Ruby-lang"
Ruby
Search vendor "Ruby-lang" for product "Ruby"
> 1.8.5 < 1.8.5.231
Search vendor "Ruby-lang" for product "Ruby" and version " > 1.8.5 < 1.8.5.231"
-
Affected
Ruby-lang
Search vendor "Ruby-lang"
Ruby
Search vendor "Ruby-lang" for product "Ruby"
>= 1.8.6 < 1.8.6.230
Search vendor "Ruby-lang" for product "Ruby" and version " >= 1.8.6 < 1.8.6.230"
-
Affected
Ruby-lang
Search vendor "Ruby-lang"
Ruby
Search vendor "Ruby-lang" for product "Ruby"
>= 1.8.7 < 1.8.7.22
Search vendor "Ruby-lang" for product "Ruby" and version " >= 1.8.7 < 1.8.7.22"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
4.0
Search vendor "Debian" for product "Debian Linux" and version "4.0"
-
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
6.06
Search vendor "Canonical" for product "Ubuntu Linux" and version "6.06"
lts
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
7.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "7.04"
-
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
7.10
Search vendor "Canonical" for product "Ubuntu Linux" and version "7.10"
-
Affected
Canonical
Search vendor "Canonical"
Ubuntu Linux
Search vendor "Canonical" for product "Ubuntu Linux"
8.04
Search vendor "Canonical" for product "Ubuntu Linux" and version "8.04"
lts
Affected