Ubuntu 11.10 USN-1377-1 Critical: ruby Cross-Site Scripting & DoS

ubuntu

February 28, 2012

Several security issues were fixed in ruby1.8.

Summary

Several security issues were fixed in ruby1.8.

Software Description:

- ruby1.8: Interpreter of object-oriented scripting language Ruby 1.8

Details:

Drew Yao discovered that the WEBrick HTTP server was vulnerable to cross-site

scripting attacks when displaying error pages. A remote attacker could use this

flaw to run arbitrary web script. (CVE-2010-0541)

Drew Yao discovered that Ruby's BigDecimal module did not properly allocate

memory on 64-bit platforms. An attacker could use this flaw to cause a denial

of service or possibly execute arbitrary code with user privileges.

(CVE-2011-0188)

Nicholas Jefferson discovered that the FileUtils.remove_entry_secure method in

Ruby did not properly remove non-empty directories. An attacker could use this

flaw to possibly delete arbitrary files. (CVE-2011-1004)

It was discovered that Ruby incorrectly allowed untainted strings to be

modified in protective safe levels. An attacker could use this flaw to bypass

intended...

Read the Full Advisory

Topics Covered

security advisory remote code execution cross-site scripting DoS Ubuntu ruby

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  libruby1.8                      1.8.7.352-2ubuntu0.1
  ruby1.8                         1.8.7.352-2ubuntu0.1

Ubuntu 11.04:
  libruby1.8                      1.8.7.302-2ubuntu0.1
  ruby1.8                         1.8.7.302-2ubuntu0.1

Ubuntu 10.10:
  libruby1.8                      1.8.7.299-2ubuntu0.1
  ruby1.8                         1.8.7.299-2ubuntu0.1

Ubuntu 10.04 LTS:
  libruby1.8                      1.8.7.249-2ubuntu0.1
  ruby1.8                         1.8.7.249-2ubuntu0.1

In general, a standard system update will make all the necessary changes.