Bug 451836 (CVE-2008-2728)

Summary: CVE-2008-2728 ruby: integer overflow in rb_ary_replace() (ruby-1.6.x) - beg + rlen
Product: [Other] Security Response Reporter: Tomas Hoger <thoger>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED DUPLICATE QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: kreilly, tagoh
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-07-01 07:00:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Tomas Hoger 2008-06-17 18:09:01 UTC 
Drew Yao of the Apple Product Security team reported an integer overflow leading
to a bypass of memory re-allocation causing a heap overflow in the
rb_ary_splice() function used by ruby interpreter for handling arrays. For
details, see:

  https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-2726

Ruby 1.6.x does not have rb_ary_splice(), but the same vulnerable code exists in
the rb_ary_replace() function.  This issue is a ruby 1.6.x equivalent of
CVE-2008-2726.
Comment 1 Tomas Hoger 2008-06-17 18:09:27 UTC 
Drew Yao's patch for rb_ary_splice():

  https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2008-2725#c1
Comment 4 Tomas Hoger 2008-06-20 18:53:17 UTC 
Public now, lifting embargo:
http://preview.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities

Patches applied upstream: (rb_ary_splice variant)
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=17460
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=17472
Comment 5 Tomas Hoger 2008-07-01 07:00:35 UTC 
Based on the analysis noted in the:

  https://bugzilla.redhat.com/show_bug.cgi?id=451821#c12

it was decided to reject this CVE id and use only CVE-2008-2726 to cover this
issue in all ruby versions.

*** This bug has been marked as a duplicate of 451828 ***