FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

ruby -- multiple vulnerabilities in safe level

Affected packages
1.8.*,1	<=	ruby	<	1.8.6.287,1
1.9.*,1	<=	ruby	<	1.9.1.0,1
1.8.*,1	<=	ruby+oniguruma	<	1.8.6.287,1
1.9.*,1	<=	ruby+oniguruma	<	1.9.1.0,1
1.8.*,1	<=	ruby+pthreads	<	1.8.6.287,1
1.9.*,1	<=	ruby+pthreads	<	1.9.1.0,1
1.8.*,1	<=	ruby+pthreads+oniguruma	<	1.8.6.287,1
1.9.*,1	<=	ruby+pthreads+oniguruma	<	1.9.1.0,1

Details

VuXML ID	c329712a-6b5b-11dd-9d79-001fc61c2a55
Discovery	2008-08-08
Entry	2008-08-16
Modified	2010-05-12

The official ruby site reports:

Several vulnerabilities in safe level have been discovereds:.

untrace_var is permitted at safe level 4;

$PROGRAM_NAME may be modified at safe level 4;

insecure methods may be called at safe level 1-3;

syslog operations are permitted at safe level 4;

dl doesn't check taintness, so it could allow attackers to call dangerous functions.

[source]

References

CVE Name	CVE-2008-3655
CVE Name	CVE-2008-3656
CVE Name	CVE-2008-3905
URL	http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/