CVE-2008-3657

2008-08-1301:41:00

CWE-20

[email protected]

web.nvd.nist.gov

ruby

dl module

bypassing safe levels

cve-2008-3657

information security

6.5 Medium

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.054 Low

EPSS

Percentile

93.0%

JSON

The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check “taintness” of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen.

CPENameOperatorVersion
ruby-lang:rubyruby-lang rubyeq1.8.3
ruby-lang:rubyruby-lang rubyeq1.8.2
ruby-lang:rubyruby-lang rubyeq1.8.4
ruby-lang:rubyruby-lang rubyeq1.8.1
ruby-lang:rubyruby-lang rubyeq1.8.7
ruby-lang:rubyruby-lang rubyeq1.9.0
ruby-lang:rubyruby-lang rubyeq1.8.6
ruby-lang:rubyruby-lang rubyeq1.8.5
ruby-lang:rubyruby-lang rubyeq1.8.0
ruby-lang:rubyruby-lang rubyeq1.6.8

CPE	Name	Operator	Version
ruby-lang:ruby	ruby-lang ruby	eq	1.8.3
ruby-lang:ruby	ruby-lang ruby	eq	1.8.2
ruby-lang:ruby	ruby-lang ruby	eq	1.8.4
ruby-lang:ruby	ruby-lang ruby	eq	1.8.1
ruby-lang:ruby	ruby-lang ruby	eq	1.8.7
ruby-lang:ruby	ruby-lang ruby	eq	1.9.0
ruby-lang:ruby	ruby-lang ruby	eq	1.8.6
ruby-lang:ruby	ruby-lang ruby	eq	1.8.5
ruby-lang:ruby	ruby-lang ruby	eq	1.8.0
ruby-lang:ruby	ruby-lang ruby	eq	1.6.8