Ruby 1.6.x up to 1.6.8, 1.8.x up to 1.8.2, and 1.9.0 development up to 2005-09-01 allows attackers to bypass safe level and taint flag protections and execute disallowed code when Ruby processes a program through standard input (stdin).

Updated ruby packages that fix an arbitrary command execution issue are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

[Updated 25 Oct 2005] Errata has been updated to include missing packages for Red Hat Enterprise Linux 3.

Ruby is an interpreted scripting language for object-oriented programming.

A bug was found in the way ruby handles eval statements. It is possible for a malicious script to call eval in such a way that can allow the bypass of certain safe-level restrictions. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-2337 to this issue.

Users of Ruby should update to these erratum packages, which contain a backported patch and are not vulnerable to this issue.

Ruby home page reports :

The Object Oriented Scripting Language Ruby supports safely executing an untrusted code with two mechanisms : safe level and taint flag on objects.

A vulnerability has been found that allows bypassing these mechanisms.

By using the vulnerability, arbitrary code can be executed beyond the restrictions specified in each safe level. Therefore, Ruby has to be updated on all systems that use safe level to execute untrusted code.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-003. This security update contains fixes for the following applications :
AppKit
ImageIO
BOM
CFNetwork
ClamAV (Mac OS X Server only)
CoreFoundation
CoreGraphics
Finder
FTPServer
Flash Player
KeyChain
LaunchServices
libcurl
Mail
MySQL Manager (Mac OS X Server only)
Preview
QuickDraw
QuickTime Streaming Server
Ruby
Safari

The remote Mac OS X host is running a version of Quicktime prior to 7.1.  The remote version of Quicktime is vulnerable to various integer and buffer overflows involving specially-crafted image and media files.  An attacker may be able to leverage these issues to execute arbitrary code on the remote host by sending a malformed file to a victim and having it opened using QuickTime player.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-003.

This security update contains fixes for the following applications :

AppKit ImageIO BOM CFNetwork ClamAV (Mac OS X Server only) CoreFoundation CoreGraphics Finder FTPServer Flash Player KeyCHain LaunchServices libcurl Mail MySQL Manager (Mac OS X Server only) Preview QuickDraw QuickTime Streaming Server Ruby Safari

Ulf Harnhammar discovered a format string vulnerability in the CDDB module's cache file handling in the Xine library, which is used by packages such as xine-ui, totem-xine, and gxine.

By tricking an user into playing a particular audio CD which has a specially crafted CDDB entry, a remote attacker could exploit this vulnerability to execute arbitrary code with the privileges of the user running the application. Since CDDB servers usually allow anybody to add and modify information, this exploit does not even require a particular CDDB server to be selected.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The object oriented scripting language Ruby supports safely executing untrusted code with two mechanisms: safe level and taint flag on objects. Dr. Yutaka Oiwa discovered a vulnerability that allows Ruby methods to bypass these mechanisms. In systems which use this feature, this could be exploited to execute Ruby code beyond the restrictions specified in each safe level.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is using a version of curl (or libcurl) that is vulnerable to a remote buffer overflows. To exploit, an attacker would have to set up a rogue web server and entice a curl user into browsing to the malicious server.  Upon successful exploitation, the attacker would be able to execute arbitrary commands with the rights of the web server.

The remote host is running Apple Mac OS X, but lacks Security Update 2005-009. This security update contains fixes for the following applications :
- Apache2
- Apache_mod_ssl
- CoreFoundation
- curl
- iodbcadmintool
- OpenSSL
- passwordserver
- Safari
- sudo
- syslog 

Yutaka Oiwa discovered a bug in Ruby, the interpreter for the object-oriented scripting language, that can cause illegal program code to bypass the safe level and taint flag protections check and be executed.

The updated packages have been patched to address this issue.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2005:799 advisory.

    Ruby is an interpreted scripting language for object-oriented programming.

    A bug was found in the way ruby handles eval statements. It is possible for     a malicious script to call eval in such a way that can allow the bypass of     certain safe-level restrictions. The Common Vulnerabilities and Exposures     project (cve.mitre.org) has assigned the name CAN-2005-2337 to this issue.

    Users of Ruby should update to these erratum packages, which contain a     backported patch and are not vulnerable to this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Yutaka Oiwa discovered a bug in Ruby, the interpreter for the object-oriented scripting language, that can cause illegal program code to bypass the safe level and taint flag protections check and be executed. The following matrix lists the fixed versions in our distributions :

                      old stable (woody)  stable (sarge)      unstable (sid)        ruby                1.6.7-3woody5       n/a                 n/a                   ruby1.6             n/a                 1.6.8-12sarge1      1.6.8-13              ruby1.8             n/a                 1.8.2-7sarge2       1.8.3-1

The remote host is using a version of curl (or libcurl) that is vulnerable to a remote buffer overflows. To exploit, an attacker would have to set up a rogue web server that would reply with a malicious NTLM authentication request.  Upon successful exploitation, the attacker would be able to execute arbitrary commands with the rights of the web server.

The remote host is using a version of wget that contains a flaw in the way that it handles NTLM authentication data.  Specifically, a rogue website that returns malformed data during an NTLM authentication session will be able to execute arbitrary code on the local client machine. 

The remote host is affected by the vulnerability described in GLSA-200510-05 (Ruby: Security bypass vulnerability)

    Dr. Yutaka Oiwa discovered that Ruby fails to properly enforce     safe level protections.
  Impact :

    An attacker could exploit this vulnerability to execute arbitrary     code beyond the restrictions specified in each safe level.
  Workaround :

    There is no known workaround at this time.

The remote host is running ClamAV, an antivirus application. There are a number of flaws that affect this version of ClamAV, and the vendor recommends upgrading to version 0.88.1 or higher. 

The remote host is using a version of wget that contains a flaw in the way that it handles NTLM authentication data.  Specifically, a rogue website that returns malformed data during an NTLM authentication session will be able to execute arbitrary code on the local client machine.

The remote host is running Apple Mac OS X, but lacks Security Update 2005-009. This security update contains fixes for the following applications :
- Apache2
- Apache_mod_ssl
- CoreFoundation
- curl
- iodbcadmintool
- OpenSSL
- passwordserver
- Safari
- sudo
- syslog

ID	Name	Product	Family	Severity
21860	CentOS 3 / 4 : ruby (CESA-2005:799)	Nessus	CentOS Local Security Checks	high
21394	FreeBSD : ruby -- vulnerability in the safe level settings (1daea60a-4719-11da-b5c6-0004614cc33d)	Nessus	FreeBSD Local Security Checks	high
3617	Mac OS X Multiple Vulnerabilities (Security Update 2006-003)	Nessus Network Monitor	Operating System Detection	medium
3616	Quicktime < 7.1 on Mac OS X Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
21341	Mac OS X Multiple Vulnerabilities (Security Update 2006-003)	Nessus	MacOS X Local Security Checks	critical
20610	Ubuntu 4.10 / 5.04 : xine-lib vulnerability (USN-196-1)	Nessus	Ubuntu Local Security Checks	high
20609	Ubuntu 4.10 / 5.04 : ruby1.8 vulnerability (USN-195-1)	Nessus	Ubuntu Local Security Checks	high
3318	Curl < 7.15.1 Multiple Remote Overflows	Nessus Network Monitor	Web Clients	critical
3308	Mac OS X Multiple Vulnerabilities (Security Update 2005-009)	Nessus Network Monitor	Operating System Detection	high
20121	Mandrake Linux Security Advisory : ruby (MDKSA-2005:191)	Nessus	Mandriva Local Security Checks	high
20049	RHEL 4 : ruby (RHSA-2005:799)	Nessus	Red Hat Local Security Checks	critical
20019	Debian DSA-864-1 : ruby1.8 - programming error	Nessus	Debian Local Security Checks	high
3256	Curl NTLM Buffer Overflow	Nessus Network Monitor	Web Clients	medium
3255	GNU WGet < 1.10.2 Buffer Overflow	Nessus Network Monitor	Web Clients	medium
19975	GLSA-200510-05 : Ruby: Security bypass vulnerability	Nessus	Gentoo Local Security Checks	high
19970	Debian DSA-862-1 : ruby1.6 - programming error	Nessus	Debian Local Security Checks	high
19968	Debian DSA-860-1 : ruby - programming error	Nessus	Debian Local Security Checks	high
3505	ClamAV < 0.88.1 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Web Clients	medium
801390	Curl NTLM Buffer Overflow	Log Correlation Engine	Web Clients	high
801386	Curl <= 7.15.0 Multiple Remote Overflows	Log Correlation Engine	Web Clients	high
801197	Quicktime < 7.1 on Mac OS X Multiple Vulnerabilities	Log Correlation Engine	Web Clients	high
800982	GNU WGet < 1.10.2 Buffer Overflow	Log Correlation Engine	Web Clients	high
800798	Mac OS X Multiple Vulnerabilities (Security Update 2005-009)	Log Correlation Engine	Operating System Detection	high

Detections

Analytics

CVE-2005-2337

critical

Tenable Plugins

high

high

medium

high

critical

high

high

critical

high

high

critical

high

medium

medium

high

high

high

medium

high

high

high

high

high