Date: Wed, 03 Oct 2012 13:48:14 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Tyler Hicks <tyhicks@...onical.com>, coley@...us.mitre.org, security@...ntu.com, security@...y-lang.org Subject: Re: CVE Request: Ruby safe level bypasses -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 10/02/2012 04:32 PM, Tyler Hicks wrote: > Hello - Upstream Ruby has fixed exception methods that > incorrectly allowed safe level bypasses. These bypasses allowed > untainted strings to be modified by untrusted code in safe level > 4. > > Note that the changes to exc_to_s() and name_err_to_s(), in > error.c, are similar to the fix for CVE-2011-1005, but the Ruby > advisory made it clear that Ruby 1.9.x was not affected by > CVE-2011-1005. It turns out that the vulnerability was later > reintroduced to Ruby's trunk in revision 29456. Ruby 1.9.3-p0 and > later is affected. > > While Shugo Maeda was fixing the issue above, he noticed that > name_err_mesg_to_str() had a similar flaw. Ruby 1.8.x, along with > 1.9.3-p0 and later is affected. > > I believe that these issues need two separate CVEs. Both issues > are fixed in the same upstream patch. Could you please allocate > ids? > > Thanks, Tyler > >  > http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068 > >  http://www.ruby-lang.org/en/news/2011/02/18/exception-methods-can-bypass-safe/ > Please use CVE-2012-4464 for this issue. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iQIcBAEBAgAGBQJQbJZ+AAoJEBYNRVNeJnmTKVwP/AwS0w4x1fIIUZ4oakCOL04s PDhRjSxppmJK3v4hXsTgXlIrb3Le0cOw0equzs07f87OBRC2Tm05Xai2Xx3a9iFZ Sa/fdR9+LSSpg8NCULvXArZYW/mOLNLFXJ7XJSK3cttOdAKb99vKnaX/nuLigFMu hnmr9+qES/rwkUiRQeik6OPNldYiQX3HxZ+ORoyCnDOx0hhX7YoV7fbGl8q2vEaQ VER+epOX2eIiYjSuyCSbUhRYt4httanoDqGUPZYnpITNs2MIrEOsrxizePnZ2RZd LjM7NilP+tGcOT9ilc6AxO/jvPGcAHARcg+s3EchTsO98ui9cn2GejyYvRHZE7Kz cQd46bQs2xigL69s/s6wA/PSTFFYrfxc0hh3pOlO3Bw44Aajz0/sKCNDeJao9+dx iD2vC3Umezv98Zrdw7wRx4kfp1Fu9Rrjl5cDMTBrsfEV26wVAlQGmaO8FljAhdAQ nFcY9rxoETeSOdhXkl9gi/J31NJ4B5F64cTUI1vNnO+X0ujxFtnftUgUykCq19Ne aTCwrrch4BUsAcwoEtBzpHMrhsnF4oeHGV0Pz2Q7yGe+bc1if4KV0GoT2jUSn8ye AbGNSwNKDSYZHRNChjbu1+Pjr3mgs9ftg2dZUdLDUqlLKhbSUlcwXvPBPYn8OWdU b/Wmxe0vimxCE5mD50gP =JCMw -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.