Multiple unspecified vulnerabilities in Ruby before 1.8.5 allow remote attackers to bypass "safe level" checks via unspecified vectors involving (1) the alias function and (2) "directory operations".

Updated ruby packages that fix security issues are now available. 

This update has been rated as having moderate security impact by the Red Hat Security Response Team. 

Ruby is an interpreted scripting language for object-oriented programming. 

Users of Ruby should upgrade to these updated packages which contain backported patches and are not vulnerable to these issues. 


From Red Hat Security Advisory 2006:0604 :

A number of flaws were found in the safe-level restrictions in Ruby.  It was possible for an attacker to create a carefully crafted malicious script that can allow the bypass of certain safe-level restrictions. (CVE-2006-3694)


From Red Hat Security Advisory 2006:0729 :

A flaw was discovered in the way Ruby's CGI module handles certain multipart/form-data MIME data.  If a remote attacker sends a specially crafted multipart-form-data request, it is possible to cause the ruby CGI script to enter an infinite loop, causing a denial of service. (CVE-2006-5467)

An attacker could bypass the 'safe level' checks. (CVE-2006-3694)

The alias function, certain directory operations, and regular expressions did not correctly implement safe levels. Depending on the application these flaws might allow attackers to bypass safe level restrictions and perform unintended operations.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An attacker could bypass the 'safe level' checks (CVE-2006-3694).

A number of flaws were discovered in the safe-level restrictions in the Ruby language. Because of these flaws, it would be possible for an attacker to create a carefully crafted malicious script that could allow them to bypass certain safe-level restrictions.

Updated packages have been patched to correct this issue.

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to the bypass of security restrictions or denial of service. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2006-1931     It was discovered that the use of blocking sockets can     lead to denial of service.

  - CVE-2006-3964     It was discovered that Ruby does not properly maintain     'safe levels' for aliasing, directory accesses and     regular expressions, which might lead to a bypass of     security restrictions.

It was discovered that the interpreter for the Ruby language does not properly maintain 'safe levels' for aliasing, directory accesses and regular expressions, which might lead to a bypass of security restrictions.

Secunia reports :

Two vulnerabilities have been reported in Ruby, which can be exploited by malicious people to bypass certain security restrictions.

- An error in the handling of the 'alias' functionality can be exploited to bypass the safe level protection and replace methods called in the trusted level.

- An error caused due to directory operations not being properly checked can be exploited to bypass the safe level protection and close untainted directory streams.

Updated ruby packages that fix security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for object-oriented programming.

A number of flaws were found in the safe-level restrictions in Ruby.
It was possible for an attacker to create a carefully crafted malicious script that can allow the bypass of certain safe-level restrictions. (CVE-2006-3694)

Users of Ruby should update to these erratum packages, which contain a backported patch and are not vulnerable to this issue.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2006:0604 advisory.

  - security flaw (CVE-2006-3694)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
67399	Oracle Linux 3 / 4 : ruby (ELSA-2006-0604 / ELSA-2006-0729)	Nessus	Oracle Linux Local Security Checks	medium
29570	SuSE 10 Security Update : ruby (ZYPP Patch Number 1946)	Nessus	SuSE Local Security Checks	medium
27903	Ubuntu 5.04 / 5.10 / 6.06 LTS : ruby1.8 vulnerability (USN-325-1)	Nessus	Ubuntu Local Security Checks	medium
27421	openSUSE 10 Security Update : ruby (ruby-1948)	Nessus	SuSE Local Security Checks	medium
23884	Mandrake Linux Security Advisory : ruby (MDKSA-2006:134)	Nessus	Mandriva Local Security Checks	medium
22699	Debian DSA-1157-1 : ruby1.8 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
22681	Debian DSA-1139-1 : ruby1.6 - missing privilege checks	Nessus	Debian Local Security Checks	medium
22139	FreeBSD : ruby -- multiple vulnerabilities (76562594-1f19-11db-b7d4-0008743bf21a)	Nessus	FreeBSD Local Security Checks	medium
22136	CentOS 3 / 4 : ruby (CESA-2006:0604)	Nessus	CentOS Local Security Checks	medium
22113	RHEL 4 : ruby (RHSA-2006:0604)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2006-3694

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical