Bug 10845 - CVE-2012-4481: ruby - Incomplete fix for CVE-2011-1005 for NameError#to_s method when used on objects
Summary: CVE-2012-4481: ruby - Incomplete fix for CVE-2011-1005 for NameError#to_s met...
Status: RESOLVED DUPLICATE of bug 7769
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 2
Hardware: i586 Linux
Priority: Normal normal
Target Milestone: ---
Assignee: Mageia Bug Squad
QA Contact: Sec team
URL: http://cve.mitre.org/cgi-bin/cvename....
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-07-26 10:53 CEST by Oden Eriksson
Modified: 2013-07-26 17:37 CEST (History)
1 user (show)

See Also:
Source RPM: ruby
CVE:
Status comment:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Oden Eriksson 2013-07-26 10:53:34 CEST 
Name: CVE-2012-4481
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4481
Final-Decision: 
Interim-Decision: 
Modified: 
Proposed: 
Assigned: 20120821
Category: 
Reference: MLIST:[oss-security] 20121005 Re: CVE Request -- ruby (1.8.x with
patched CVE-2011-1005):  Incomplete fix for CVE-2011-1005 for NameError#to_s
method when used on objects
Reference: URL:http://www.openwall.com/lists/oss-security/2012/10/05/4
Reference: CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=863484
Reference: REDHAT:RHSA-2013:0612
Reference: URL:http://rhn.redhat.com/errata/RHSA-2013-0612.html
Reference: REDHAT:RHSA-2013:0129
Reference: URL:http://rhn.redhat.com/errata/RHSA-2013-0129.html

The safe-level feature in Ruby 1.8.7 allows context-dependent
attackers to modify strings via the NameError#to_s method when
operating on Ruby objects.  NOTE: this issue is due to an incomplete
fix for CVE-2011-1005.

Reproducible: 

Steps to Reproduce:
Comment 1 Oden Eriksson 2013-07-26 10:54:50 CEST 
NOTE: this is fixed in updates_testing/ruby-1.8.7.p358-1.3.mga2.src.rpm with:

ruby-1.8.7-p358-CVE-2012-4466-CVE-2012-4481.patch
Comment 2 Oden Eriksson 2013-07-26 10:58:47 CEST 
How I hate the mga rpm changelogs...

Status: NEW => RESOLVED
Resolution: (none) => INVALID

Comment 3 David Walser 2013-07-26 17:37:05 CEST 
Fixed in Bug 7769.

*** This bug has been marked as a duplicate of bug 7769 ***

CC: (none) => luigiwalser
Resolution: INVALID => DUPLICATE
Note You need to log in before you can comment on or make changes to this bug.