Уязвимость CVE-2008-2726: Информация

Описание

Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption, aka the "beg + rlen" issue. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change.

Важность: HIGH (7,8)

URL: https://nvd.nist.gov/vuln/detail/CVE-2008-2726

Опубликовано: 24 июня 2008 г.

Изменено: 1 ноября 2018 г.

Идентификатор типа ошибки: CWE-189

Ссылки на рекомендации, решения и инструменты

Ссылка	Ресурс
http://blog.phusion.nl/2008/06/23/ruby-186-p230187-broke-your-app-ruby-enterprise-edition-to-the-rescue/	Third Party Advisory
http://weblog.rubyonrails.org/2008/6/21/multiple-ruby-security-vulnerabilities	Third Party Advisory
http://www.matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities/	Third Party Advisory
http://www.ruby-forum.com/topic/157034	Third Party Advisory
http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.html	Third Party Advisory
http://www.zedshaw.com/rants/the_big_ruby_vulnerabilities.html	Broken Link
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=17460	Vendor Advisory
http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/	Patch Vendor Advisory
29903	Third Party Advisory VDB Entry
[fedora-security-commits] 20080620 fedora-security/audit f10, 1.7, 1.8 f8, 1.225, 1.226 f9, 1.215, 1.216	Third Party Advisory
DSA-1612	Third Party Advisory
31256	Third Party Advisory
DSA-1618	Third Party Advisory
http://support.apple.com/kb/HT2163	Third Party Advisory
31181	Third Party Advisory
30802	Third Party Advisory
31090	Third Party Advisory
RHSA-2008:0561	Third Party Advisory
31062	Third Party Advisory
1020347	Third Party Advisory VDB Entry
https://bugs.launchpad.net/ubuntu/+source/ruby1.8/+bug/241657	Third Party Advisory
FEDORA-2008-5649	Third Party Advisory
30831	Third Party Advisory
SUSE-SR:2008:017	Third Party Advisory
APPLE-SA-2008-06-30	Mailing List Third Party Advisory
31687	Third Party Advisory
MDVSA-2008:141	Third Party Advisory
MDVSA-2008:140	Third Party Advisory
MDVSA-2008:142	Third Party Advisory
https://issues.rpath.com/browse/RPL-2626	Broken Link
30875	Third Party Advisory
30867	Third Party Advisory
USN-621-1	Third Party Advisory
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0206	Broken Link
SSA:2008-179-01	Third Party Advisory
30894	Third Party Advisory
33178	Third Party Advisory
GLSA-200812-17	Third Party Advisory
ADV-2008-1907	Third Party Advisory
ADV-2008-1981	Third Party Advisory
ruby-rbarysplice-begrlen-code-execution(43351)	Third Party Advisory VDB Entry
oval:org.mitre.oval:def:9959	Third Party Advisory
20080626 rPSA-2008-0206-1 ruby	Third Party Advisory VDB Entry

Подверженные конфигурации:
1. Конфигурация 1
  cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
  End including
  1.8.4
  cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
  Start including
  1.8.6
  End excliding
  1.8.6.230
  cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
  Start including
  1.8.7
  End excliding
  1.8.7.22
  cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
  Start including
  1.9.0
  End excliding
  1.9.0.2
  cpe:2.3:a:ruby-lang:ruby:*:*:*:*:*:*:*:*
  Start including
  1.8.5
  End excliding
  1.8.5.231
  
  Конфигурация 2
  cpe:2.3:o:debian:debian_linux:4.0:*:*:*:*:*:*:*
  
  Конфигурация 3
  cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:7.10:*:*:*:*:*:*:*
  cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*

Версия: v24.5.3

Наверх

Уязвимость CVE-2008-2726: Информация

Описание

Ссылки на рекомендации, решения и инструменты

Конфигурация 1

Конфигурация 2

Конфигурация 3