Published: 13/08/2008 Updated: 11/10/2018

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 760

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Ruby 1.8.5 and previous versions, 1.8.6 up to and including 1.8.6-p286, 1.8.7 up to and including 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent malicious users to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 up to and including 3.

Vulnerable Product	Search on Vulmon	Subscribe to Product
ruby-lang ruby 1.8.1
ruby-lang ruby 1.8.2
ruby-lang ruby 1.8.3
ruby-lang ruby 1.8.4
ruby-lang ruby 1.8.5
ruby-lang ruby 1.8.6
ruby-lang ruby 1.8.7
ruby-lang ruby 1.6.8
ruby-lang ruby 1.9.0
ruby-lang ruby
ruby-lang ruby 1.8.0

Akira Tagoh discovered a vulnerability in Ruby which lead to an integer overflow If a user or automated system were tricked into running a malicious script, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program (CVE-2008-2376) ...

Synopsis Moderate: ruby security update Type/Severity Security Advisory: Moderate Topic Updated ruby packages that fix various security issues are now availablefor Red Hat Enterprise Linux 21This update has been rated as having moderate security impact by the RedHat Security Response Team Descri ...

Synopsis Moderate: ruby security update Type/Severity Security Advisory: Moderate Topic Updated ruby packages that fix several security issues are now availablefor Red Hat Enterprise Linux 3This update has been rated as having moderate security impact by the RedHat Security Response Team Descript ...

Synopsis Moderate: ruby security update Type/Severity Security Advisory: Moderate Topic Updated ruby packages that fix several security issues are now availablefor Red Hat Enterprise Linux 4 and 5This update has been rated as having moderate security impact by the RedHat Security Response Team De ...

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service and other security problems The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2008-3655 Keita Yamaguchi discovered that several safe level restrictions are insufficiently enforced ...

source: wwwsecurityfocuscom/bid/30644/info Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service: - Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation Attackers can leverage these issues to make insecure ...

source: wwwsecurityfocuscom/bid/30644/info Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service: - Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation Attackers can leverage these issues to make insecur ...

CVE-2008-3655

Vulnerability Summary

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect