CVE-2014-2734
Ruby 2.x - Signature Spoofing via OpenSSL Extension Memory State
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-2734. PoCs published by adrienthebo, gdisneyleugers.
AI-analyzed exploit summary This PoC demonstrates a certificate signing vulnerability in OpenSSL where a CA certificate can be signed with a key that does not match its public key, exploiting CVE-2014-2734. The script uses Ruby and the OpenSSL library to show the flaw in certificate verification.
Description
The openssl extension in Ruby 2.x does not properly maintain the state of process memory after a file is reopened, which allows remote attackers to spoof signatures within the context of a Ruby script that attempts signature verification after performing a certain sequence of filesystem operations. NOTE: this issue has been disputed by the Ruby OpenSSL team and third parties, who state that the original demonstration PoC contains errors and redundant or unnecessarily-complex code that does not appear to be related to a demonstration of the issue. As of 20140502, CVE is not aware of any public comment by the original researcher
Exploits (2)
This PoC demonstrates a certificate signing vulnerability in OpenSSL where a CA certificate can be signed with a key that does not match its public key, exploiting CVE-2014-2734. The script uses Ruby and the OpenSSL library to show the flaw in certificate verification.
This repository contains a README describing CVE-2014-2734, a vulnerability in Ruby OpenSSL where a CA private key can be spoofed if a public key is issued before the private key is written and the script is reopened. The PoC is referenced but not included in the repository.