The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist     before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a     denial of service, or execute arbitrary code via crafted GEM packages. (CVE-2007-0469)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist
    before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a
    denial of service, or execute arbitrary code via crafted GEM packages. (CVE-2007-0469)

This update fixes a vulnerability in rubygems that allowed to overwrite files with root privileges. (CVE-2007-0469)

ID	Name	Product	Family	Type	Severity
217037	Linux Distros Unpatched Vulnerability : CVE-2007-0469	Nessus	Misc.	Local	high
413064	SCA: security update for rubygems-update (GHSA-95vx-q4c2-64gr)	Tenable Cloud Security	SCA Checks	Local	high
413064	SCA: security update for rubygems-update (GHSA-95vx-q4c2-64gr)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
27424	openSUSE 10 Security Update : rubygems (rubygems-2644)	Nessus	SuSE Local Security Checks	Local	high

Detections

Analytics

CVE-2007-0469

high

Tenable Plugins

high

high

high

high