CVE-2011-1005

La funcionalidad safe-level de Ruby 1.8.6 hasta la versión 1.8.6-420, 1.8.7 hasta la 1.8.7-330 y 1.8.8dev permite a atacantes, dependiendo del contexto, modificar cadenas de texto a través del método Exception#to_s method, como se ha demostrado cambiando el pathname previsto.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. A flaw was found in the way large amounts of memory were allocated on 64-bit systems when using the BigDecimal class. A context-dependent attacker could use this flaw to cause memory corruption, causing a Ruby application that uses the BigDecimal class to crash or, possibly, execute arbitrary code. This issue did not affect 32-bit systems. It was found that WEBrick did not filter terminal escape sequences from its log files. A remote attacker could use specially-crafted HTTP requests to inject terminal escape sequences into the WEBrick log files. If a victim viewed the log files with a terminal emulator, it could result in control characters being executed with the privileges of that user. Various other issues were also addressed.