Date: Tue, 2 Oct 2012 15:32:15 -0700 From: Tyler Hicks <tyhicks@...onical.com> To: coley@...us.mitre.org Cc: oss-security@...ts.openwall.com, security@...ntu.com, security@...y-lang.org Subject: CVE Request: Ruby safe level bypasses Hello - Upstream Ruby has fixed exception methods that incorrectly allowed safe level bypasses. These bypasses allowed untainted strings to be modified by untrusted code in safe level 4. Note that the changes to exc_to_s() and name_err_to_s(), in error.c, are similar to the fix for CVE-2011-1005, but the Ruby advisory made it clear that Ruby 1.9.x was not affected by CVE-2011-1005. It turns out that the vulnerability was later reintroduced to Ruby's trunk in revision 29456. Ruby 1.9.3-p0 and later is affected. While Shugo Maeda was fixing the issue above, he noticed that name_err_mesg_to_str() had a similar flaw. Ruby 1.8.x, along with 1.9.3-p0 and later is affected. I believe that these issues need two separate CVEs. Both issues are fixed in the same upstream patch. Could you please allocate ids? Thanks, Tyler  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068  http://www.ruby-lang.org/en/news/2011/02/18/exception-methods-can-bypass-safe/ [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ