CVE-2007-0469

2007-01-2401:28:00

mitre

web.nvd.nist.gov

cve-2007-0469

rubygems

installer.rb

file overwrite

denial of service

arbitrary code execution

security vulnerability

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.5

Confidence

Low

EPSS

0.02

Percentile

88.9%

JSON

The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.

Affected configurations

Nvd

Node

rubyforgerubygemsRange≤0.9.0

rubyforgerubygemsMatch0.8.11

VendorProductVersionCPE
rubyforgerubygems*cpe:2.3:a:rubyforge:rubygems:*:*:*:*:*:*:*:*
rubyforgerubygems0.8.11cpe:2.3:a:rubyforge:rubygems:0.8.11:*:*:*:*:*:*:*