CVE-2011-1004

Ruby Arbitrary File Deletion via Symlink Attack

Title source: llm
STIX 2.1

Description

The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, 1.8.8dev, 1.9.1 through 1.9.1-430, 1.9.2 through 1.9.2-136, and 1.9.3dev allows local users to delete arbitrary files via a symlink attack.

References (16)

Core 16
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0910.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/46460
Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/02/21/5
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0539
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2011-0909.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43573
Patch mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2011/02/21/2
Third Party Advisory, VDB Entry vdb-entry x_refsource_osvdb
http://osvdb.org/70958
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054422.html
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054436.html
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43434
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT5281
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:097
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2012/May/msg00001.html

Scores

EPSS 0.0039
EPSS Percentile 30.2%

Details

CWE
CWE-59
Status published
Products (6)
ruby-lang/ruby 1.8.6
ruby-lang/ruby 1.8.7
ruby-lang/ruby 1.8.8 dev
ruby-lang/ruby 1.9.1
ruby-lang/ruby 1.9.2
ruby-lang/ruby 1.9.3 dev
Published Mar 02, 2011
Tracked Since Feb 18, 2026