Bug 199543 – ruby safe-level bypass

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 199543 - ruby safe-level bypass

Summary:	ruby safe-level bypass

Status:	CLOSED ERRATA

Aliases:	None

Product:	Fedora
Classification:	Fedora
Component:	ruby (Show other bugs)
Sub Component:
Version:	rawhide
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Akira TAGOH
QA Contact:	Bill Huang
Docs Contact:

URL:
Whiteboard:
Keywords:	Security

Depends On:
Blocks:	199545
	Show dependency tree / graph

Reported:	2006-07-20 05:47 EDT by Akira TAGOH
Modified:	2007-11-30 17:11 EST (History)
CC List:	1 user (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2006-07-23 23:17:28 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
testcase (96 bytes, text/plain) 2006-07-20 05:47 EDT, Akira TAGOH	no flags	Details
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Akira TAGOH 2006-07-20 05:47:14 EDT

Description of problem:
A Vulneerability has been reported in Ruby, which can be exploited by malicious
people to bypass certain security-level restrictions.

Version-Release number of selected component (if applicable):
all versions of Ruby, such as 1.6.x and 1.8.x without any exceptions.

How reproducible:
always

Steps to Reproduce:
1.ruby alias_jvn83768862.patch
2.
3.
  
Actual results:
no exceptions.

Expected results:
$ ruby alias_jvn83768862.patch
alias_jvn83768862.patch:9:in `p': calling insecure method: inspect (SecurityError)
        from alias_jvn83768862.patch:9


Additional info:
thia affects to FC4 and FC5 as well.

Comment 1 Akira TAGOH 2006-07-20 05:47:14 EDT

Created attachment 132736 [details]
testcase

Comment 2 Akira TAGOH 2006-07-20 06:57:12 EDT

obviously .patch is a typo. it should be s/.patch/.rb/, but anyway ;)

Comment 3 Akira TAGOH 2006-07-21 07:57:25 EDT

Fixed in:
devel - 1.8.4-11.fc6
FC-5  - 1.8.4-8.fc5
FC-4  - 1.8.4-3.fc4

Comment 4 Fedora Update System 2006-07-22 15:07:07 EDT

ruby-1.8.4-8.fc5 has been pushed for fc5, which should resolve this issue.  If these problems are still present in this version, then please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.