rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:3466 advisory.

    Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the     challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a     model-view-controller (MVC) framework for web application development. Action Pack implements the     controller and the view components.

    Security Fix(es):

    * rubyzip: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip     file (CVE-2018-1000544)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    This update fixes various bugs and adds enhancements. Documentation for these changes is available from     the Release Notes document.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

rubyzip gem version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem.

This attack appear to be exploitable via if a site allows uploading of .zip files, an attacker can upload a malicious file that contains symlinks or files with absolute pathnames '../' to write arbitrary files to the filesystem..

For Debian 9 stretch, this problem has been fixed in version 1.2.0-1.1+deb9u1.

We recommend that you upgrade your ruby-zip packages.

For the detailed security status of ruby-zip please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-zip

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was found that rubyzip, a Ruby module for reading and writing zip files, contained a Directory Traversal vulnerability that can be exploited to write arbitrary files to the filesystem.

For Debian 8 'Jessie', this problem has been fixed in version 1.1.6-1+deb8u2.

We recommend that you upgrade your ruby-zip packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
194065	RHEL 7 : CloudForms 4.6.5 (RHSA-2018:3466)	Nessus	Red Hat Local Security Checks	critical
139250	Debian DLA-2307-1 : ruby-zip security update	Nessus	Debian Local Security Checks	critical
111764	Debian DLA-1467-1 : ruby-zip security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2018-1000544

critical

Tenable Plugins

critical

critical

critical