Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 524
Alerts This Week
Warning Icon 1 524

Ubuntu 12.04 LTS USN-1583-1 Critical Update: Ruby Remote Exploit

ubuntu
Calendar Grey September 26, 2012
Scroller Ubuntu
Safety Alert USN-2547-2 relates to Python vulnerabilities on Ubuntu 18.04 LTS, implementing updates to strengthen defenses against potential threats.
Several security issues were fixed in ruby1.9.1

Summary

Several security issues were fixed in ruby1.9.1

Software Description:

- ruby1.9.1: Interpreter of object-oriented scripting language Ruby

Details:

It was discovered that Ruby incorrectly allowed untainted strings to be

modified in protective safe levels. An attacker could use this flaw to bypass

intended access restrictions. (CVE-2011-1005)

John Firebaugh discovered that the RubyGems remote gem fetcher did not properly

verify SSL certificates. A remote attacker could exploit this to perform a man

in the middle attack to alter gem files being downloaded for installation.

(CVE-2012-2126)

John Firebaugh discovered that the RubyGems remote gem fetcher allowed

redirection from HTTPS to HTTP. A remote attacker could exploit this to perform

a man in the middle attack to alter gem files being downloaded for

installation. (CVE-2012-2125)

Topics%20covered

Topics Covered

security advisory remote exploit critical ubuntu ruby access restrictions SSL verification

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  libruby1.9.1                    1.9.3.0-1ubuntu2.2

In general, a standard system update will make all the necessary changes.

References

CVE-2011-1005, CVE-2012-2125, CVE-2012-2126

Severity
critical
Lowest
Low
Medium
High
Critical

September 26, 2012

Topics%20covered

Topics Covered

security advisory remote exploit critical ubuntu ruby access restrictions SSL verification

Package Information

https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.0-1ubuntu2.2

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.