CVE-2008-3655

Executive Summary

Informations
Name	CVE-2008-3655	First vendor Publication	2008-08-12
Vendor	Cve	Last vendor Modification	2011-03-07

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score	7.5	Attack Range	Network
Cvss Impact Score	6.4	Attack Complexity	Low
Cvss Expoit Score	10	Authentification	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3655

CWE : Common Weakness Enumeration

id	Name
CWE-264	Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:11602

Oval ID:	oval:org.mitre.oval:def:11602
Title:	Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.
Description:	Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-3655	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section ruby-mode is earlier than 0:1.6.8-13.el3 AND ruby-docs is earlier than 0:1.6.8-13.el3 AND ruby-devel is earlier than 0:1.6.8-13.el3 AND ruby-tcltk is earlier than 0:1.6.8-13.el3 AND ruby is earlier than 0:1.6.8-13.el3 AND irb is earlier than 0:1.6.8-13.el3 AND ruby-libs is earlier than 0:1.6.8-13.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section ruby-mode is earlier than 0:1.8.1-7.el4_7.1 AND ruby-docs is earlier than 0:1.8.1-7.el4_7.1 AND ruby-devel is earlier than 0:1.8.1-7.el4_7.1 AND ruby-tcltk is earlier than 0:1.8.1-7.el4_7.1 AND ruby is earlier than 0:1.8.1-7.el4_7.1 AND irb is earlier than 0:1.8.1-7.el4_7.1 AND ruby-libs is earlier than 0:1.8.1-7.el4_7.1 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section ruby-ri is earlier than 0:1.8.5-5.el5_2.5 AND ruby-mode is earlier than 0:1.8.5-5.el5_2.5 AND ruby-docs is earlier than 0:1.8.5-5.el5_2.5 AND ruby-devel is earlier than 0:1.8.5-5.el5_2.5 AND ruby is earlier than 0:1.8.5-5.el5_2.5 AND ruby-libs is earlier than 0:1.8.5-5.el5_2.5 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_2.5 AND ruby-irb is earlier than 0:1.8.5-5.el5_2.5 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_2.5

CPE : Common Platform Enumeration

Type	Description	Count
Application	Ruby-Lang Ruby cpe:/a:ruby-lang:ruby:1.9.0 cpe:/a:ruby-lang:ruby:1.8.7:preview4 cpe:/a:ruby-lang:ruby:1.8.7:preview2 cpe:/a:ruby-lang:ruby:1.8.7:p22 cpe:/a:ruby-lang:ruby:1.8.7:p71 cpe:/a:ruby-lang:ruby:1.8.7:p17 cpe:/a:ruby-lang:ruby:1.8.7 cpe:/a:ruby-lang:ruby:1.8.7:preview1 cpe:/a:ruby-lang:ruby:1.8.7:preview3 cpe:/a:ruby-lang:ruby:1.8.6:preview2 cpe:/a:ruby-lang:ruby:1.8.6:p114 cpe:/a:ruby-lang:ruby:1.8.6:p230 cpe:/a:ruby-lang:ruby:1.8.6:p111 cpe:/a:ruby-lang:ruby:1.8.6:p36 cpe:/a:ruby-lang:ruby:1.8.6:preview1 cpe:/a:ruby-lang:ruby:1.8.6 cpe:/a:ruby-lang:ruby:1.8.6:p286 cpe:/a:ruby-lang:ruby:1.8.6:p110 cpe:/a:ruby-lang:ruby:1.8.6:preview3 cpe:/a:ruby-lang:ruby:1.8.5:p113 cpe:/a:ruby-lang:ruby:1.8.5:p35 cpe:/a:ruby-lang:ruby:1.8.5:p115 cpe:/a:ruby-lang:ruby:1.8.5:preview3 cpe:/a:ruby-lang:ruby:1.8.5:preview1 cpe:/a:ruby-lang:ruby:1.8.5:preview4 cpe:/a:ruby-lang:ruby:1.8.5:p12 cpe:/a:ruby-lang:ruby:1.8.5:p2 cpe:/a:ruby-lang:ruby:1.8.5:preview2 cpe:/a:ruby-lang:ruby:1.8.5:preview5 cpe:/a:ruby-lang:ruby:1.8.5 cpe:/a:ruby-lang:ruby:1.8.5:p11 cpe:/a:ruby-lang:ruby:1.8.4:preview2 cpe:/a:ruby-lang:ruby:1.8.4:preview1 cpe:/a:ruby-lang:ruby:1.8.4 cpe:/a:ruby-lang:ruby:1.8.4:preview3 cpe:/a:ruby-lang:ruby:1.8.3:preview1 cpe:/a:ruby-lang:ruby:1.8.3:preview2 cpe:/a:ruby-lang:ruby:1.8.3 cpe:/a:ruby-lang:ruby:1.8.3:preview3 cpe:/a:ruby-lang:ruby:1.8.2:preview4 cpe:/a:ruby-lang:ruby:1.8.2 cpe:/a:ruby-lang:ruby:1.8.2:preview2 cpe:/a:ruby-lang:ruby:1.8.2:preview3 cpe:/a:ruby-lang:ruby:1.8.1:-9 cpe:/a:ruby-lang:ruby:1.8.1 cpe:/a:ruby-lang:ruby:1.8.0 cpe:/a:ruby-lang:ruby:1.6.8	47

Open Source Vulnerability Database (OSVDB)

id	Description
47470	Ruby Safe Level Multiple Function Restriction Bypass

Internal Sources (Detail)

Source	Url
APPLE	http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
BID	http://www.securityfocus.com/bid/30644
BUGTRAQ	http://www.securityfocus.com/archive/1/archive/1/495884/100/0/threaded
CERT	http://www.us-cert.gov/cas/techalerts/TA09-133A.html
CONFIRM	http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494401 http://support.apple.com/kb/HT3549 http://support.avaya.com/elmodocs2/security/ASA-2008-424.htm http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0264 http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/
DEBIAN	http://www.debian.org/security/2008/dsa-1651 http://www.debian.org/security/2008/dsa-1652
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00259... https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00299...
GENTOO	http://security.gentoo.org/glsa/glsa-200812-17.xml
REDHAT	http://www.redhat.com/support/errata/RHSA-2008-0895.html http://www.redhat.com/support/errata/RHSA-2008-0897.html
SECTRACK	http://www.securitytracker.com/id?1020656
SECUNIA	http://secunia.com/advisories/31430 http://secunia.com/advisories/31697 http://secunia.com/advisories/32165 http://secunia.com/advisories/32219 http://secunia.com/advisories/32255 http://secunia.com/advisories/32256 http://secunia.com/advisories/32371 http://secunia.com/advisories/32372 http://secunia.com/advisories/33178 http://secunia.com/advisories/35074
UBUNTU	http://www.ubuntulinux.org/support/documentation/usn/usn-651-1
VUPEN	http://www.vupen.com/english/advisories/2008/2334 http://www.vupen.com/english/advisories/2009/1297
XF	http://xforce.iss.net/xforce/xfdb/44369

Alert History

If you want to see full details history, please login or register.

Date	Informations
2013-05-11 00:23:35	Multiple Updates

Type	Count
Oval ID(s)	1
CPE ID(s)	47
osvdb(s)	1

Related	Severity
TA09-133A	(Critical)
GLSA-200812-17	(Critical)
USN-651-1	(High)
RHSA-2008:0897	(High)
MDVSA-2008:226	(High)
DSA-1652	(High)
DSA-1651	(High)
RHSA-2008:0896	(High)
RHSA-2008:0895	(High)