# Arbitrary code execution vulnerabilities

**URL:** <https://www.ruby-forum.com/t/arbitrary-code-execution-vulnerabilities/141043>\
**Category:** Ruby\
**Created:** [June 21, 2008, 6:48am UTC](https://www.ruby-forum.com/t/arbitrary-code-execution-vulnerabilities/141043 "2008-06-21T06:48:31Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![asplake](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@asplake](https://www.ruby-forum.com/u/asplake)\
**Post date:** [June 21, 2008, 6:48am UTC](https://www.ruby-forum.com/t/arbitrary-code-execution-vulnerabilities/141043/1 "2008-06-21T06:48:31Z")

</div>

You may want to take immediate action on this.  
[http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/](http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/)

Some people seem to be seeing problems with the 1.8.6-p230 upgrade,  
though.  
See comments at:  
[http://weblog.rubyonrails.com/2008/6/21/multiple-ruby-security-vulnerabilities](http://weblog.rubyonrails.com/2008/6/21/multiple-ruby-security-vulnerabilities)

---

<div class="post-metadata">

**Author:** ![asplake](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@asplake](https://www.ruby-forum.com/u/asplake)\
**Post date:** [June 21, 2008, 8:33am UTC](https://www.ruby-forum.com/t/arbitrary-code-execution-vulnerabilities/141043/2 "2008-06-21T08:33:29Z")

</div>

From: Mike B. [[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)]

# Some people seem to be seeing problems with the 1.8.6-p230 upgrade,

# though.

# See comments at:

# [Peak Obsession](http://weblog.rubyonrails.com/2008/6/21/multiple-ruby-security)

# -vulnerabilities

ruby is not rails. upgrading ruby does not mean you’ve upgraded rails  
too. wait for the rails upgrade. ask the rails list or dhh.

kind regards -botp

---

<div class="post-metadata">

**Author:** ![asplake](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@asplake](https://www.ruby-forum.com/u/asplake)\
**Post date:** [June 21, 2008, 6:43pm UTC](https://www.ruby-forum.com/t/arbitrary-code-execution-vulnerabilities/141043/3 "2008-06-21T18:43:40Z")

</div>

Jeremy K. wrote:

> You misunderstood. The latest patchlevels of 1.8.5 and 1.8.6 are segfaulting.
> 
> jeremy

1. Is this on simple reproducible cases or do you need Rails to get a  
segfault?

2. gdb is your friend. 🙂

---

<div class="post-metadata">

**Author:** ![asplake](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@asplake](https://www.ruby-forum.com/u/asplake)\
**Post date:** [June 21, 2008, 9:20am UTC](https://www.ruby-forum.com/t/arbitrary-code-execution-vulnerabilities/141043/4 "2008-06-21T09:20:56Z")

</div>

On Fri, Jun 20, 2008 at 11:31 PM, Peña, Botp [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> From: Mike B. [[mailto:removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)]
> 
> # Some people seem to be seeing problems with the 1.8.6-p230 upgrade,
> 
> # though.
> 
> # See comments at:
> 
> # [Peak Obsession](http://weblog.rubyonrails.com/2008/6/21/multiple-ruby-security)
> 
> # -vulnerabilities
> 
> ruby is not rails. upgrading ruby does not mean you’ve upgraded rails too. wait for the rails upgrade. ask the rails list or dhh.

You misunderstood. The latest patchlevels of 1.8.5 and 1.8.6 are  
segfaulting.

jeremy

---

<div class="post-metadata">

**Author:** ![asplake](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/2bfe46/32.png) [@asplake](https://www.ruby-forum.com/u/asplake)\
**Post date:** [June 22, 2008, 7:36am UTC](https://www.ruby-forum.com/t/arbitrary-code-execution-vulnerabilities/141043/5 "2008-06-22T07:36:35Z")

</div>

Situation summary from RubyInside  
[http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.html](http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.html)

Updates on Drew Yao’s Terrible Ruby Vulnerabilities [Matasano Security]  
[http://www.matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities/](http://www.matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities/)