bugs.debian.orgConfirmation
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401 CVE-2008-3657
Ruby 1.9 dl - Module DL.dlopen Arbitrary Library Access
Record summary
CVE-2008-3657 has a selected CVSS score of 7.5; EIP currently links 1 catalogued exploit.
Description
The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Proofs of concept
1Catalogued exploits
ExploitDBRuby 1.9 dl - Module DL.dlopen Arbitrary Library AccessExploitDB exploitby Keita YamaguchiNot analyzed1 file
References
Showing 12 of 31APPLE-SA-2009-05-12Vendor advisory
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html 31430Third-party advisory
http://secunia.com/advisories/31430 31697Third-party advisory
http://secunia.com/advisories/31697 32165Third-party advisory
http://secunia.com/advisories/32165 32219Third-party advisory
http://secunia.com/advisories/32219 32255Third-party advisory
http://secunia.com/advisories/32255 32256Third-party advisory
http://secunia.com/advisories/32256 32371Third-party advisory
http://secunia.com/advisories/32371 33178Third-party advisory
http://secunia.com/advisories/33178 35074Third-party advisory
http://secunia.com/advisories/35074 GLSA-200812-17Vendor advisory
http://security.gentoo.org/glsa/glsa-200812-17.xml