A vulnerability was found on WEBrick, a part of Ruby's standard library. WEBrick lets attackers to inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim's terminal emulator. We already have a fix for it. Releases for every active branches are to follow this announce. But for a meantime, we recommend you to avoid looking at your WEBrick logs, until you update your WEBrick process. Detailed description Terminal escape sequences are used to allow various forms of interaction between a terminal and a inside process. The problem is that those sequences are not intended to be issued by untrusted sources; such as network inputs. So if a remote attacker could inject escape sequences into WEBrick logs, and a victim happen to consult them through his/her terminal, the attacker could take advantages of various weaknesses in terminal emulators. http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection/
Created attachment 383108 [details] patch generated by diffing 1.8.7p248 and p249 to fix the issue
Testcase taken from the ruby blog: % xterm -e ruby -rwebrick -e 'WEBrick::HTTPServer.new(:Port=>8080).start' & % wget http://localhost:8080/%1b%5d%32%3b%6f%77%6e%65%64%07%0a
Upstream has also made available 1.8.6p388: http://ftp.ruby-lang.org/pub/ruby/ruby-1.8.6-p388.tar.bz2
(In reply to comment #2) > Created an attachment (id=383108) [details] > patch generated by diffing 1.8.7p248 and p249 to fix the issue http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=26268
On Fedora rawhide: patch applied on ruby-1.8.6.383-6.fc13.
Well, bodhi <-> bugzilla interaction doesn't seem to be working currently.. F-12: https://admin.fedoraproject.org/updates/ruby-1.8.6.383-6.fc12 F=11: https://admin.fedoraproject.org/updates/ruby-1.8.6.383-6.fc11
ruby-1.8.6.383-6.fc12 has been pushed to the Fedora 12 stable repository. If problems still persist, please make note of it in this bug report.
ruby-1.8.6.383-6.fc11 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.
On Fedora side this is closed.
This issue has been addressed in following products: Red Hat Enterprise Linux 4 Via RHSA-2011:0908 https://rhn.redhat.com/errata/RHSA-2011-0908.html
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2011:0909 https://rhn.redhat.com/errata/RHSA-2011-0909.html