ruby: multiple insufficient safe mode restrictions

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via 1 untracevar, 2...

Moderate: Red Hat Security Advisory: ruby security update

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for quick and easy object-oriented programming. T...

Moderate: Red Hat Security Advisory: ruby security update

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for quick and easy object-oriented...

Moderate: Red Hat Security Advisory: ruby security update

Updated ruby packages that fix various security issues are now available for Red Hat Enterprise Linux 2.1. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for quick and easy object-oriented programming....

USN-651-1: Ruby vulnerabilities

Akira Tagoh discovered a vulnerability in Ruby which lead to an integer overflow. If a user or automated system were tricked into running a malicious script, an attacker could cause a denial of service or possibly execute arbitrary code with the privileges of the user invoking the program...

Gentoo Security Advisory GLSA 200510-05 (ruby)

The remote host is missing updates announced in advisory GLSA 200510-05. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

FreeBSD Ports: ruby, ruby_static

The remote host is missing an update to the system as announced in the referenced advisory. VID 1daea60a-4719-11da-b5c6-0004614cc33d OpenVAS Vulnerability Test $ Description: Auto generated from vuxml or freebsd advisories Authors: Thomas Reinke Copyright: Copyright c 2008 E-Soft Inc...

FreeBSD : ruby -- multiple vulnerabilities in safe level (c329712a-6b5b-11dd-9d79-001fc61c2a55)

The official ruby site reports : Several vulnerabilities in safe level have been discovereds:. - untracevar is permitted at safe level 4; - $PROGRAMNAME may be modified at safe level 4; - insecure methods may be called at safe level 1-3; - syslog operations are permitted at safe level 4; - dl...

Security fix for the ALT Linux 5 package ruby version 1.8.7-alt6

Aug. 12, 2008 Kirill A. Shutemov 1.8.7-alt6 - 1.8.7.72 + Multiple vulnerabilities + Several vulnerabilities in safe level + untracevar is permitted at safe level 4 + $PROGRAMNAME may be modified at safe level 4 + insecure methods may be called at safe level 1-3 + syslog operations are permitted a...

Ruby 1.9 - Safe Level Multiple Function Restriction Bypass

source: https://www.securityfocus.com/bid/30644/info Ruby is prone to multiple vulnerabilities that can be leveraged to bypass security restrictions or cause a denial of service: - Multiple security-bypass vulnerabilities occur because of errors in the 'safe level' restriction implementation...

ruby -- multiple vulnerabilities in safe level

The official ruby site reports: Several vulnerabilities in safe level have been discovereds:. untracevar is permitted at safe level 4; $PROGRAMNAME may be modified at safe level 4; insecure methods may be called at safe level 1-3; syslog operations are permitted at safe level 4; dl doesn't check...

Ruby vulnerability caused by a problem with the alias funtion so that safe level 4 does not function as a sandbox

Overview Safe levels exist as a part of the Ruby language security model, in order to limit the operation of untrusted objects. Ruby contains a vulnerability which may allow an attacker to bypass the safe level restrictions and execute normally inaccessible methods, due to a problem in Ruby's ali...

Ruby contains a vulnerability that prevents safe level 4 from functioning as a sandbox.

Overview Safe level is a security model provided by Ruby language that limits the operation of untrusted objects. A vulnerability that allows an attacker to bypass the safe level restrictions and execute inaccessible methods ex. destructive methods was confirmed. Impact An attacker may be able to...

Ruby vulnerability allowing to bypass safe level 4 as a sandbox

Overview Ruby is a object-oriented scripting language that supports execution of untrusted code with two mechanisms: "object taint" and "safe level". Ruby contains a vulnerability that may allow an attacker to execute an arbitrary script by bypassing the "safe level" checks. Impact An attacker...

Debian: Security Advisory (DSA-860-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2008 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian Security Advisory DSA 862-1 (ruby1.8)

The remote host is missing an update to ruby1.8 announced via advisory DSA 862-1. OpenVAS Vulnerability Test $Id: deb8621.nasl 6616 2017-07-07 12:10:49Z cfischer $ Description: Auto-generated from advisory DSA 862-1 Authors: Thomas Reinke Copyright: Copyright c 2007 E-Soft Inc...

SuSE 10 Security Update : ruby (ZYPP Patch Number 1946)

An attacker could bypass the 'safe level' checks. CVE-2006-3694 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The text description of this plugin is C Novell, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid29570; scriptversion"1.12";...

openSUSE 10 Security Update : ruby (ruby-1948)

An attacker could bypass the 'safe level' checks CVE-2006-3694. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update ruby-1948. The text description of this plugin is C SUSE LLC...

Fedora Core 5 : ruby-1.8.4-8.fc5 (2006-849)

Thu Jul 20 2006 Akira TAGOH - 1.8.4-8 - security fixes CVE-2006-3694 - ruby-1.8.4-fix-insecure-dir-operation.patch : - ruby-1.8.4-fix-insecure-regexp-modification.patch: fixed the insecure operations in the certain safe-level restrictions. 199538 - ruby-1.8.4-fix-alias-safe-level.patch: fixed to...

Fedora Core 4 : ruby-1.8.4-3.fc4 (2006-842)

Thu Jul 20 2006 Akira TAGOH - 1.8.4-3 - security fixes CVE-2006-3694 - ruby-1.8.4-fix-insecure-dir-operation.patch : - ruby-1.8.4-fix-insecure-regexp-modification.patch: fixed the insecure operations in the certain safe-level restrictions. 199538 - ruby-1.8.4-fix-alias-safe-level.patch: fixed to...