cgi.rb$B$N(BDoS$B@H<e@-$K$D$$$F(B

MoonWolfe$B$G$9!#e(B

cgi.rbe$B$K%^%k%A%Q!<%H=hM};~$Ne(BDoSe$B@H<e@-$,$"$k$H$$$&Js9pe(B(CVE-2006-5467)e$B$re(B
e$BFI$_$^$7$?!#e(B

http://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html
http://en.securitylab.ru/nvd/276121.php

CVSe$B$r$_$k$He(B9/23e$B$K=$@5$5$l$F$$$^$9$M!#e(B
1e$B%v7n0J>e7P$D$N$K%“%J%&%s%9$J$7$H$$$&$N$O!”@H<e@-$H$7$FG’$a$F$$$J$$$+$ie(B
e$B$G$7$g$&$+e(B?

e$B$I$N$h$&$KBP1~$9$kM=Dj$G$9$+e(B?

(a)1.8.5e$B$K:GDc8B$N%Q%C%A$rEv$F$?$b$N$r%j%j!<%9$9$ke(B

  • e$B%P!<%8%g%s$Oe(B1.8.6? 1.8.5.1? 1.8.5p1?
    (b)1.8.6e$B$r%j%j!<%9$9$k$^$G%Q%C%A$N$_$GBP1~$9$ke(B
  • e$B%G%#%9%H%j%S%e!<%?$K%Q%C%A:Q$_%P%$%J%j$r:n$C$F$b$i$&$h$&e(B
    e$B$*4j$$$7$J$$$H$$$1$J$$e(B?
  • Mandriva,Fedorae$B$O$9$G$Ke(BFixe$B$7$?$b$N$rDs6!$7$F$$$^$9!#e(B
  • e$B$A$J$_$Ke(BDebian
    unstablee$B$Ne(BRubye$B$O%Q%C%A$,$"$?$C$F$$$^$;$s!#e(B
    ruby 1.8.5 (2006-08-25) [i486-linux]

e$B0J2<!"e(Bcgi.rbe$B$r$6$C$HD/$a$?46A[$G$9!#e(B

e$BH]Dj7A$NJ8;z%/%i%9$Oe(B[\x00-\x1f\x7f-\xff]e$B$J$I$NHse(BASCIIe$BJ8;z$K$be(B
e$B%^%C%A$7$F$7$^$$$^$9!#5v2D$9$kJ8;z$rL@<($9$k$h$&$K$7$^$7$g$&!#e(B

  • [\r\n]{1,2}e$B$H$$$&I=8=$O2?$r0U?^$7$F$$$^$9$+e(B?
    e$B$3$N$^$^$@$He(B"\r\r",“\n
    n”,“\n\r"e$B$b<u$1IU$1$F$7$^$&!#e(B(\r?\n|\r)e$B$H=q$/$Y$-e(B?
    EOLe$B$,e(B”\r"e$B$H$$$&2DG=@-$ODc$$$7%7%s%W%k$Ke(B(?:\r?\n)e$B$G$$$$$+$b$7$l$^$;$s!#e(B

read_multiparte$B$Ne(Bheade$B$N07$$$,;(!#$-$A$s$H%Q!<%9$7$?$[$&$,$$$$$H;W$&!#e(B

Integer(str)e$B$OIi$N?t$b<u$1IU$1$^$9!#@5$N?t$@$1$,M_$7$$$N$G$O$J$$$G$9$+e(B?

e$B$^$D$b$He(B e$B$f$-$R$m$G$9e(B

In message “Re: [ruby-dev:29726] cgi.rbe$B$Ne(BDoSe$B@H<e@-$K$D$$$Fe(B”
on Wed, 1 Nov 2006 03:12:17 +0900, MoonWolf [email protected]
writes:

|cgi.rbe$B$K%^%k%A%Q!<%H=hM};~$Ne(BDoSe$B@H<e@-$,$“$k$H$$$&Js9pe(B(CVE-2006-5467)e$B$re(B
|e$BFI$$^$7$?!#e(B
|
|http://rubyforge.org/pipermail/mongrel-users/2006-October/001946.html
|http://en.securitylab.ru/nvd/276121.php
|Félicitations ! Votre domaine a bien été créé chez OVHcloud !
|
|CVSe$B$r$
$k$He(B9/23e$B$K=$@5$5$l$F$$$^$9$M!#e(B
|1e$B%v7n0J>e7P$D$N$K%”%J%&%s%9$J$7$H$$$&$N$O!"@H<e@-$H$7$FG’$a$F$$$J$$$+$ie(B
|e$B$G$7$g$&$+e(B?

e$B@H<e@-$H$7$FG’$a$F$$$J$$$o$1$G$O$J$$$G$9$,!“$3$N<o$Ne(BDoSe$B@H<ee(B
e$B@-$OB>$N$b$N$h$j$bM%@hEY$ODc$$$H9M$($F$O$$$^$9!#@5D>!”$3$A$ie(B
e$B$N8B$i$l$?%j%=!<%9$r3d$-$?$/$J$$$G$9!#$G$9$+$i!"e(B

|e$B$I$N$h$&$KBP1~$9$kM=Dj$G$9$+e(B?
|
|(a)1.8.5e$B$K:GDc8B$N%Q%C%A$rEv$F$?$b$N$r%j%j!<%9$9$ke(B
| * e$B%P!<%8%g%s$Oe(B1.8.6? 1.8.5.1? 1.8.5p1?
|(b)1.8.6e$B$r%j%j!<%9$9$k$^$G%Q%C%A$N$$GBP1~$9$ke(B
| * e$B%G%#%9%H%j%S%e!<%?$K%Q%C%A:Q$
%P%$%J%j$r:n$C$F$b$i$&$h$&e(B
| e$B$*4j$$$7$J$$$H$$$1$J$$e(B?
| * Mandriva,Fedorae$B$O$9$G$Ke(BFixe$B$7$?$b$N$rDs6!$7$F$$$^$9!#e(B
| * e$B$A$J$_$Ke(BDebian unstablee$B$Ne(BRubye$B$O%Q%C%A$,$"$?$C$F$$$^$;$s!#e(B
| ruby 1.8.5 (2006-08-25) [i486-linux]

e$B>e$NJ,N`$G$Oe(B(b)e$B$G$9!#$^$?$3$A$i$+$i%G%#%9%H%j%S%e!<%?$K$J$Ke(B
e$B$+0MMj$9$kM=Dj$b$"$j$^$;$s!#e(B

|e$B0J2<!"e(Bcgi.rbe$B$r$6$C$HD/$a$?46A[$G$9!#e(B

e$B8!F$$7$F$O$_$^$9!#%Q%C%A$J$I$,$"$l$P4?7^$7$^$9!#e(B

MoonWolfe$B$G$9!#e(B

Yukihiro M. wrote:

|CVSe$B$r$_$k$He(B9/23e$B$K=$@5$5$l$F$$$^$9$M!#e(B
|1e$B%v7n0J>e7P$D$N$K%"%J%&%s%9$J$7$H$$$&$N$O!"@H<e@-$H$7$FG’$a$F$$$J$$$+$ie(B
|e$B$G$7$g$&$+e(B?

e$B@H<e@-$H$7$FG’$a$F$$$J$$$o$1$G$O$J$$$G$9$,!"$3$N<o$Ne(BDoSe$B@H<ee(B
e$B@-$OB>$N$b$N$h$j$bM%@hEY$ODc$$$H9M$($F$O$$$^$9!#@5D>!"$3$A$ie(B
e$B$N8B$i$l$?%j%=!<%9$r3d$-$?$/$J$$$G$9!#$G$9$+$i!"e(B

e$BM%@hEY$,Dc$$$HH=CG$7$?$N$O$^$D$b$H$5$s$NFHCG$G$9$+e(B?
[email protected]$B$NHs8x3+e(BMLe$B$G5DO@$5$l$?$&$($G$N7kO@$G$9$+e(B?
e$B!V@H<e@-$H$7$FG’$a$F$$$J$$$o$1$G$O$J$$!W$N$G$"$l$P8x<0%5%$%H$Ne(B
e$B%;%-%e%j%F%#$N%Z!<%8$K7G:$9$kI,MW$,$"$k$N$G$O$J$$$G$9$+e(B?

|(b)1.8.6e$B$r%j%j!<%9$9$k$^$G%Q%C%A$N$_$GBP1~$9$ke(B
e$B>e$NJ,N`$G$Oe(B(b)e$B$G$9!#$^$?$3$A$i$+$i%G%#%9%H%j%S%e!<%?$K$J$Ke(B
e$B$+0MMj$9$kM=Dj$b$"$j$^$;$s!#e(B

e$B$J$<8x<0$J%Q%C%A$,Ds6!$5$l$F$$$J$$$N$G$9$+e(B?
e$B%G%#%9%H%j%S%e!<%?$KHs8x<0%Q%C%A$N<h<NA*Br$N@UG$$r;$$jIU$1$F$$$^$;$s$+e(B?

|e$B0J2<!“e(Bcgi.rbe$B$r$6$C$HD/$a$?46A[$G$9!#e(B
e$B8!F$$7$F$O$_$^$9!#%Q%C%A$J$I$,$”$l$P4?7^$7$^$9!#e(B

e$B;d$N!V8B$i$l$?%j%=!<%9$r3d$-$?$/$J$$!W$N$G%Q%C%A$O=q$-$?$/$"$j$^$;$s!#e(B

e$B$^$D$b$He(B e$B$f$-$R$m$G$9e(B

In message “Re: [ruby-dev:29729] Re:
cgi.rbe$B$Ne(BDoSe$B@H<e@-$K$D$$$Fe(B”
on Wed, 1 Nov 2006 20:17:02 +0900, MoonWolf [email protected]
writes:

|e$BM%@hEY$,Dc$$$HH=CG$7$?$N$O$^$D$b$H$5$s$NFHCG$G$9$+e(B?

e$B;d$NFHCG$G$9!#e(B

|[email protected]$B$NHs8x3+e(BMLe$B$G5DO@$5$l$?$&$($G$N7kO@$G$9$+e(B?
|e$B!V@H<e@-$H$7$FG’$a$F$$$J$$$o$1$G$O$J$$!W$N$G$“$l$P8x<0%5%$%H$Ne(B
|e$B%;%-%e%j%F%#$N%Z!<%8$K7G:$9$kI,MW$,$”$k$N$G$O$J$$$G$9$+e(B?

e$BI,MW$,L5$$$H$O8@$$$^$;$s!#e(B

|> |(b)1.8.6e$B$r%j%j!<%9$9$k$^$G%Q%C%A$N$_$GBP1~$9$ke(B
|> e$B>e$NJ,N`$G$Oe(B(b)e$B$G$9!#$^$?$3$A$i$+$i%G%#%9%H%j%S%e!<%?$K$J$Ke(B
|> e$B$+0MMj$9$kM=Dj$b$"$j$^$;$s!#e(B
|
|e$B$J$<8x<0$J%Q%C%A$,Ds6!$5$l$F$$$J$$$N$G$9$+e(B?
|e$B%G%#%9%H%j%S%e!<%?$KHs8x<0%Q%C%A$N<h<NA*Br$N@UG$$r;$$jIU$1$F$$$^$;$s$+e(B?

e$B$$C$7$c$k$3$H$,$h$/$o$+$j$^$;$s!#%G%#%9%H%j%S%e!<%?$K$O$J$$e(B
e$B!V@UG$!W$,;d$K$O$"$k$H$
$C$7$c$C$F$k$s$G$9$+$M!#3N$+!VL5J]>Z!We(B
e$B$O%i%$%;%s%9$N0lIt$H$7$F$O$C$-$j$H$&$?$C$F$"$k$H;W$&$N$G$9$,!#e(B

|> |e$B0J2<!“e(Bcgi.rbe$B$r$6$C$HD/$a$?46A[$G$9!#e(B
|> e$B8!F$$7$F$O$_$^$9!#%Q%C%A$J$I$,$”$l$P4?7^$7$^$9!#e(B
|
|e$B;d$N!V8B$i$l$?%j%=!<%9$r3d$-$?$/$J$$!W$N$G%Q%C%A$O=q$-$?$/$"$j$^$;$s!#e(B

e$B$^!“$=$l$O$=$l$G$7$g$&$,$J$$$G$9$h$M!#;d$be(BMoonWolfe$B$5$s$b!”%je(B
e$B%=!<%9$OM-8B$J$s$G$9$+$i!"<+J,$,;H$$$?$$$h$&$K%j%=!<%9$r;H$&e(B
e$B$G$7$g$&!#e(B

                            e$B$^$D$b$He(B e$B$f$-$R$me(B /:|)

e$BF#2,$G$9!#e(B

|CVSe$B$r$_$k$He(B9/23e$B$K=$@5$5$l$F$$$^$9$M!#e(B
|1e$B%v7n0J>e7P$D$N$K%"%J%&%s%9$J$7$H$$$&$N$O!"@H<e@-$H$7$FG’$a$F$$$J$$$+$ie(B
|e$B$G$7$g$&$+e(B?

e$B@H<e@-$H$7$FG’$a$F$$$J$$$o$1$G$O$J$$$G$9$,!"$3$N<o$Ne(BDoSe$B@H<ee(B
e$B@-$OB>$N$b$N$h$j$bM%@hEY$ODc$$$H9M$($F$O$$$^$9!#@5D>!"$3$A$ie(B
e$B$N8B$i$l$?%j%=!<%9$r3d$-$?$/$J$$$G$9!#$G$9$+$i!"e(B

e$B$3$l$@$+$i$H$$$C$F!"e(B

|e$B0J2<!“e(Bcgi.rbe$B$r$6$C$HD/$a$?46A[$G$9!#e(B
e$B8!F$$7$F$O$_$^$9!#%Q%C%A$J$I$,$”$l$P4?7^$7$^$9!#e(B

e$B;d$N!V8B$i$l$?%j%=!<%9$r3d$-$?$/$J$$!W$N$G%Q%C%A$O=q$-$?$/$"$j$^$;$s!#e(B

e$B$3$N7kO@$K$J$k$s$@$C$?$i!"7k6I%j%=!<%9$,A4A3$J$$$s$@$+$i!"e(B
e$BJ|CV$K$J$C$F$7$^$&$N$G$O$J$$$N$G$7$g$&$+!#e(B
e$B%*!<%W%s%=!<%9$K$O8@$$$@$7$C$Z$NK!B’$,E,MQ$5$l$^$9#we(B

MoonWolfe$B$G$9!#e(B

Yukihiro M. wrote:

|[email protected]$B$NHs8x3+e(BMLe$B$G5DO@$5$l$?$&$($G$N7kO@$G$9$+e(B?
|e$B!V@H<e@-$H$7$FG’$a$F$$$J$$$o$1$G$O$J$$!W$N$G$"$l$P8x<0%5%$%H$Ne(B
|e$B%;%-%e%j%F%#$N%Z!<%8$K7G:$9$kI,MW$,$"$k$N$G$O$J$$$G$9$+e(B?

e$BI,MW$,L5$$$H$O8@$$$^$;$s!#e(B

e$B$d$C$He(BWebe$B$K7G:$5$l$^$7$?$M!#e(B
e$B$*$D$+$l$5$^$G$7$?!#$H!“8@$$$?$$$H$3$m$G$9$,!”$^$@$$$/$D$+LdBj$,$"$j$^$9!#e(B

  • e$B%Q%C%A$,$"$?$C$F$$$k$+$I$&$+e(Bruby
    -ve$B$de(BRUBY_RELEASE_DATEe$B$G6hJL$G$-$J$$!#e(B
    • CGI::REVISIONe$B$G$J$s$H$+H=JL2DG=e(B
      *
      e$B%Q%C%A$rEv$F$?%U%!%$%k$Oe(B1.68.2.18e$B$K$J$k$,!“e(BCVSe$B$+$i<hF@$G$-$ke(B
      1.68.2.18e$B$H$O<BBN$,0[$J$ke(B(1.68.2.17e$B$NJQ99$,4^$^$l$F$$$J$$e(B)e$B$N$Ge(B
      e$B:.Mp$N85$G$”$k!#e(B
      *
      e$B$9$Y$F$N%i%$%V%i%j$Ge(BREVISIONe$B$,<hF@$G$-$k$o$1$G$O$J$$$N$G!"e(B
      e$B:#8eCm0U$,I,MW!#:#2s$O$?$^$?$^1?$,NI$+$C$?$@$1!#e(B
    • e$B%7%’%k$,3+J|$5$l$F$$$J$$%5!<%P$@$HBgJQ!#e(B
  • e$B%Q%C%A$Ne(Bmd5sume$B$,$J$$!#e(B
  • e$B%Q%C%A$N%_%i!<$,$J$$!#e(B
    • cvsweb.cgie$B$K$h$kF0E*$J=PNO$G$O?4$b$H$J$$!#@EE*$J%U%!%$%k$H$7$Fe(B
      e$B$-$A$s$H%%i!<$5$l$k>l=j$KCV$$$FM$7$$!#e(B

1.8.5e$B$,%j%j!<%9$5$l$?$N$Oe(B2006/8/25e$B$J$N$K!“e(B2006/9/4e$B$H$Ne(Bdiffe$B$G$”$k!#e(B

  • 1.68.2.17e$B$NJQ99$,%Q%C%A$K8=$l$J$+$C$?$N$O6vA3e(B?

e$B$3$s$K$A$O!"$J$+$`$ie(B(e$B$&e(B)e$B$G$9!#e(B

In message “[ruby-dev:29745] Re: cgi.rbe$B$Ne(BDoSe$B@H<e@-$K$D$$$Fe(B”
on Nov.02,2006 22:29:48, [email protected] wrote:
| * e$B%Q%C%A$Ne(Bmd5sume$B$,$J$$!#e(B
| * e$B%Q%C%A$N%%i!<$,$J$$!#e(B
| * cvsweb.cgie$B$K$h$kF0E*$J=PNO$G$O?4$b$H$J$$!#@EE*$J%U%!%$%k$H$7$Fe(B
| e$B$-$A$s$H%
%i!<$5$l$k>l=j$KCV$$$FM_$7$$!#e(B

e$B$4;XE&$O$4$b$C$H$b$J$N$G!"@EE*$J%U%!%$%k$rMQ0U$7$F!“4XO”$9$ke(B
e$B5-=R$r99?7$7$^$7$?!#e(B

| * 1.8.5e$B$,%j%j!<%9$5$l$?$N$Oe(B2006/8/25e$B$J$N$K!“e(B2006/9/4e$B$H$Ne(Bdiffe$B$G$”$k!#e(B
| * 1.68.2.17e$B$NJQ99$,%Q%C%A$K8=$l$J$+$C$?$N$O6vA3e(B?

e$B$3$l$Oe(B[ruby-dev:29746]e$B$G?@8M$5$s$,@bL@$7$F$/$@$5$C$F$$$kDL$je(B
e$B$G!":#2s$N@H<e@-$H4X78$N$J$$JQ99$r=|$$$?:9J,$r=P$7$?$@$1$G$9!#e(B

e$B$=$l$G$O!#e(B

In message [email protected]
on Thu, 2 Nov 2006 22:29:48 +0900,
MoonWolf [email protected] wrote:

e$B$d$C$He(BWebe$B$K7G:$5$l$^$7$?$M!#e(B
e$B$*$D$+$l$5$^$G$7$?!#$H!“8@$$$?$$$H$3$m$G$9$,!”$^$@$$$/$D$+LdBj$,$"$j$^$9!#e(B

  • e$B%Q%C%A$,$"$?$C$F$$$k$+$I$&$+e(Bruby -ve$B$de(BRUBY_RELEASE_DATEe$B$G6hJL$G$-$J$$!#e(B
    • CGI::REVISIONe$B$G$J$s$H$+H=JL2DG=e(B
      e$B$3$l$G$9$,!“e(BCVSe$B$N%-!<%o!<%IE83+$5$l$?$b$N$O!“e(Bpkgsrce$B$de(Bportse$B$N$h$&$Je(BCVS
      e$B$G4IM}$7$F$$$k%7%9%F%`$G!”$A$g$C$H07$$$K$/$$ItJ,$,$”$j$^$9!#e(B
* e$B%Q%C%A$rEv$F$?%U%!%$%k$Oe(B1.68.2.18e$B$K$J$k$,!"e(BCVSe$B$+$i<hF@$G$-$ke(B
  1.68.2.18e$B$H$O<BBN$,0[$J$ke(B(1.68.2.17e$B$NJQ99$,4^$^$l$F$$$J$$e(B)e$B$N$Ge(B
  e$B:.Mp$N85$G$"$k!#e(B

e$B$=$&$$$&0UL#$G$O!"e(BCGI::REVISIONe$B$OEv$F$K$O$J$i$J$$$H$$$&$3$H$G$9!#e(B

  • e$B%7%‘%k$,3+J|$5$l$F$$$J$$%5!<%P$@$HBgJQ!#e(B
    e$B%l%s%?%k%5!<%Pe(B?
    e$B$=$&$$$C$?>l9g$O!"$=$N%5!<%P$G%7%’%k$r;H$($k4IM}<T$,e(B
    e$B$-$A$s$H99?7$9$Y$-$G$O$J$$$N$+$7$ie(B?
  • e$B%Q%C%A$Ne(Bmd5sume$B$,$J$$!#e(B
  • e$B%Q%C%A$N%_%i!<$,$J$$!#e(B
    • cvsweb.cgie$B$K$h$kF0E*$J=PNO$G$O?4$b$H$J$$!#@EE*$J%U%!%$%k$H$7$Fe(B
      e$B$-$A$s$H%%i!<$5$l$k>l=j$KCV$$$FM$7$$!#e(B
      e$B$3$l$O;d$b$=$NJ}$,NI$$$H;W$$$^$9!#e(B
  • 1.8.5e$B$,%j%j!<%9$5$l$?$N$Oe(B2006/8/25e$B$J$N$K!“e(B2006/9/4e$B$H$Ne(Bdiffe$B$G$”$k!#e(B
    • 1.68.2.17e$B$NJQ99$,%Q%C%A$K8=$l$J$+$C$?$N$O6vA3e(B?
      e$B$*$=$i$/!“:#2s$N%;%-%e%j%F%#$NLdBj$KD>@\4X78$N$J$$!“8_49@-$rB;$J$&62$le(B
      e$B$,$”$ke(Bnkfe$B$K4X$9$kJQ99$,e(B1.68.2.17e$B$G9T$o$l$F$$$k$?$a$G$7$g$&!#%;%-%e%j%F%#e(B
      e$BBP1~$N%Q%C%A$N$?$a$G$”$l$P!"$A$g$&$Ie(B1.68.2.17e$B$He(B1.68.2.18e$B$N:9J,$G$A$g$&e(B
      e$B$INI$$$3$H$K$J$j$^$9!#e(B

MoonWolfe$B$G$9!#e(B

Takahiro K. wrote:

* e$B%Q%C%A$rEv$F$?%U%!%$%k$Oe(B1.68.2.18e$B$K$J$k$,!"e(BCVSe$B$+$i<hF@$G$-$ke(B
  1.68.2.18e$B$H$O<BBN$,0[$J$ke(B(1.68.2.17e$B$NJQ99$,4^$^$l$F$$$J$$e(B)e$B$N$Ge(B
  e$B:.Mp$N85$G$"$k!#e(B

e$B$=$&$$$&0UL#$G$O!"e(BCGI::REVISIONe$B$OEv$F$K$O$J$i$J$$$H$$$&$3$H$G$9!#e(B

e$B<BBN$,0c$&$N$G$"$l$P!“e(BREVISIONe$B$rJQ$($kI,MW$,$”$k$N$G$Oe(B?
1.68.2.17e$B$K$h$k=hM}$N0c$$$r@bL@$9$k$N$K!Ve(B1.68.2.17e$B0J9_!W$H$$$&I=8=$,e(B
e$B$G$-$^$;$s$M!#e(B

  • e$B%7%’%k$,3+J|$5$l$F$$$J$$%5!<%P$@$HBgJQ!#e(B
    e$B%l%s%?%k%5!<%Pe(B? e$B$=$&$$$C$?>l9g$O!"$=$N%5!<%P$G%7%’%k$r;H$($k4IM}<T$,e(B
    e$B$-$A$s$H99?7$9$Y$-$G$O$J$$$N$+$7$ie(B?

e$B<+J,$N<Z$j$F$$$k%5!<%P$G%Q%C%A$,$"$?$C$F$$$k$+<+J,$G3NG’$9$k$3$H$,Fq$7$$e(B
e$B$H$$$&$3$H$G$9!#e(B
e$B$$$A$$$A4IM}<T$KLd$$9g$o$;$k$+!"e(BCGI::REVISIONe$B$rI=<($5$;$ke(BCGIe$B$J$I$r:n$C$Fe(B
e$B3NG’$7$J$/$F$O$$$1$^$;$s!#e(B

  • 1.8.5e$B$,%j%j!<%9$5$l$?$N$Oe(B2006/8/25e$B$J$N$K!“e(B2006/9/4e$B$H$Ne(Bdiffe$B$G$”$k!#e(B
    • 1.68.2.17e$B$NJQ99$,%Q%C%A$K8=$l$J$+$C$?$N$O6vA3e(B?
      e$B$*$=$i$/!":#2s$N%;%-%e%j%F%#$NLdBj$KD>@\4X78$N$J$$!“8_49@-$rB;$J$&62$le(B
      e$B$,$”$ke(Bnkfe$B$K4X$9$kJQ99$,e(B1.68.2.17e$B$G9T$o$l$F$$$k$?$a$G$7$g$&!#%;%-%e%j%F%#e(B
      e$BBP1~$N%Q%C%A$N$?$a$G$"$l$P!"$A$g$&$Ie(B1.68.2.17e$B$He(B1.68.2.18e$B$N:9J,$G$A$g$&e(B
      e$B$INI$$$3$H$K$J$j$^$9!#e(B

1.68.2.17e$B$K$h$kJQ99$,9T$NDI2C!":o=|$rH<$o$J$$%7%s%W%k$J$b$N$G$"$C$?$+$ie(B
e$BNI$$$b$N$N!"J#;($JJQ99$r$^$?$$$G$$$?$i%Q%C%A$H$7$F$J$j$?$?$J$+$C$?$H$$$&e(B
e$B$3$H$G$9!#e(B
1.6.28.16e$B$KBP$9$k%Q%C%A$N$O$:$J$N$K!"e(B1.6.28.17e$B$KBP$9$ke(Bdiffe$B$H$$$&$N$O!"e(B
e$B%Q%C%A$rEv$F$k;~$KIT0B$K$J$j$^$;$s$+e(B?

MoonWolfe$B$G$9!#e(B

U.Nakamura wrote:

| * e$B%Q%C%A$Ne(Bmd5sume$B$,$J$$!#e(B
| * e$B%Q%C%A$N%%i!<$,$J$$!#e(B
| * cvsweb.cgie$B$K$h$kF0E*$J=PNO$G$O?4$b$H$J$$!#@EE*$J%U%!%$%k$H$7$Fe(B
| e$B$-$A$s$H%
%i!<$5$l$k>l=j$KCV$$$FM_$7$$!#e(B

e$B$4;XE&$O$4$b$C$H$b$J$N$G!"@EE*$J%U%!%$%k$rMQ0U$7$F!“4XO”$9$ke(B
e$B5-=R$r99?7$7$^$7$?!#e(B

e$B$"$j$,$H$&$4$6$$$^$9!#e(B
e$B$7$+$7!"?7$7$$%Q%C%A$K$bLdBj$,$"$j$^$9!#e(B
CGI::REVISIONe$B$,e(B1.68.2.16e$B$N$^$^$G$9!#e(B
e$B%Q%C%A$,$"$?$C$F$$$k$+3NG’$9$kJ}K!$H$7$Fe(BCGI::REVISIONe$B$r;29M$K$G$-$J$$$He(B
e$B$$$&$3$H$G$9!#e(B
e$BJQ99$5$l$?9T$r<+J,$GL;k$7$F3NG’$7$J$$$H%Q%C%A$,$"$?$C$F$$$k$+$o$+$j$^$;$s!#e(B

e$B$3$s$K$A$O!"$J$+$`$ie(B(e$B$&e(B)e$B$G$9!#e(B

In message “[ruby-dev:29753] Re: cgi.rbe$B$Ne(BDoSe$B@H<e@-$K$D$$$Fe(B”
on Nov.03,2006 11:16:51, [email protected] wrote:
| e$B$7$+$7!“?7$7$$%Q%C%A$K$bLdBj$,$”$j$^$9!#e(B
| CGI::REVISIONe$B$,e(B1.68.2.16e$B$N$^$^$G$9!#e(B
| e$B%Q%C%A$,$“$?$C$F$$$k$+3NG’$9$kJ}K!$H$7$Fe(BCGI::REVISIONe$B$r;29M$K$G$-$J$$$He(B
| e$B$$$&$3$H$G$9!#e(B
| e$BJQ99$5$l$?9T$r<+J,$GL;k$7$F3NG’$7$J$$$H%Q%C%A$,$”$?$C$F$$$k$+$o$+$j$^$;$s!#e(B

e$B$=$l$,LdBj$G$“$k$+$I$&$+$O5DO@$NM>CO$,$”$k$H;W$$$^$9!#e(B
e$B$G$9$,!“;d$b$I$&$d$i%j%=!<%9$,B-$j$F$J$/$F$3$N7o$K$D$$$F5DO@e(B
e$B$9$k$@$1$NM>NO$O$J$5$=$&$G$9!#e(B
e$B$*Bj$@$1Ds6!$7$H$-$^$9$N$G!”$3$N7o$K%j%=!<%9$,3d$1$kJ}!9$K$*e(B
e$B$^$+$;$7$^$9!#e(B

(1) e$B%Q%C%A$rEv$F$?$G$“$m$&?M$K3NG’$;$:$K%W%m%0%i%E*$K%Q%C%Ae(B e$B$,Ev$?$C$F$$$k$+$I$&$+$r3NG'$G$-$k$h$&$K$7$J$$I,A3@-$OB8e(B e$B:_$9$k$N$+e(B (2) e$B$=$NI,A3@-$,B8:_$9$k$H2>Dj$7$F!"%Q%C%A$,Ev$?$C$F$$$k$+$Ie(B e$B$&$+$r%W%m%0%i%E*$K3NG’$9$k$N$Ke(BCGI::REVISIONe$B$,E,@Z$J<jCJe(B
e$B$J$N$+e(B
(3)
e$B$b$7e(BCGI::REVISIONe$B$,E,@Z$G$J$$$H$7$?$i!”$I$N$h$&$J<jCJ$,E,e(B
e$B@Z$H9M$($i$l$k$+e(B
(4)
e$B0J>e$rF’$^$($?>e$G!"$=$l$K$+$+$k%3%9%He(B(e$BC/$+$N%j%=!<%9$r;He(B
e$B$&$s$G$7$g$&$M$(e(B)e$B$,8z2L$K8+9g$C$F$$$k$N$+e(B

e$B$=$l$G$O!#e(B

MoonWolfe$B$G$9!#e(B

U.Nakamura wrote:

(2) e$B$=$NI,A3@-$,B8:_$9$k$H2>Dj$7$F!"%Q%C%A$,Ev$?$C$F$$$k$+$Ie(B
e$B$&$+$r%W%m%0%i%`E*$K3NG’$9$k$N$Ke(BCGI::REVISIONe$B$,E,@Z$J<jCJe(B
e$B$J$N$+e(B

CGI::REVISIONe$B$,E,@Z$@$H$O8@$C$F$$$^$;$s!#e(B
e$B:#2s$+$m$&$8$Fe(BCGI::REVISIONe$B$G%Q%C%A$,$“$?$C$F$$$k$+3NG’$G$-$?$+$ie(B
e$BNc$H$7$F$”$2$?$@$1$G$9!#e(B
e$B8=:_$G$O$b$&e(BCGI::REVISIONe$B$G$9$i?.MQ$G$-$^$;$s$,e(B^^;

e$B$“$H!”%W%m%0%i%E*$K3NG'$9$k$3$H$@$1$G$O$J$/?M4V$,3NG'$7$F0B?4$9$k$?$a$Ne(B e$B<jCJ$rMQ0U$7$FM_$7$$$H$$$&$3$H$,;d$N<q;]$G$9!#e(B e$B$b$7e(BCe$B8@8lItJ,$K@H<e@-$,$"$C$?>l9g!"%P%$%J%j$rFI$a$k?M$G$G$b$J$$$H3NG'$Ge(B e$B$-$^$;$s!#e(B CGI::REVISIONe$B$K$h$C$F%W%m%0%i%$N=hM}$r@Z$jBX$($k$J$I$H$$$C$?$3$H$OA[Dje(B
e$B$7$F$$$^$;$s!#e(B(e$B$9$/$J$/$H$b%;%-%e%j%F%#$NJQ99$K4X$7$F$Oe(B)

http://www.ruby-lang.org/ja/news/2006/11/02/CVE-2006-5467/

e$B@H<e@-$NB8:_$9$k%P!<%8%g%se(B
1.8e$B7Oe(B
1.8.5e$B0JA0$NA4$F$N%P!<%8%g%se(B
e$B3+H/HGe(B(1.9e$B7Oe(B)
2006-09-23e$B0JA0$NA4$F$N%P!<%8%g%se(B

e$B%Q%C%A$r$“$F$F$b!”@H<e@-$NB8:_$9$k!V%P!<%8%g%se(B1.8.5e$B0JA0!W$N$^$^$G$"$Ce(B
e$B$F!"K\Ev$KBP:v$G$-$?$N$+H=CG$G$-$^$;$s$,$=$l$G$b$$$$$He(B?

(3) e$B$b$7e(BCGI::REVISIONe$B$,E,@Z$G$J$$$H$7$?$i!"$I$N$h$&$J<jCJ$,E,e(B
e$B@Z$H9M$($i$l$k$+e(B

[ruby-dev:29726]e$B$G$Oe(B(a)e$B$H$7$Fe(BRubye$B<+BN$N%P!<%8%g%s$r$“$2$k$H$$$&e(B
e$BJL$NABr;h$bDs<($7$F$$$^$9!#e(B
e$B$9$G$KA
Br;h$,Ds<($5$l$F$$$k$K$b4X$o$i$:!”$3$N$h$&$J=q$-J}$r$9$k$N$Oe(B
e$B%U%‘%“$G$O$”$j$^$;$s!#e(B
e$B$3$N$^$^C/$b0U8+$r=P$5$:$K%U%’!<%I%"%&%H$5$;$?$$$N$G$9$+e(B?

(4) e$B0J>e$rF’$^$($?>e$G!"$=$l$K$+$+$k%3%9%He(B(e$BC/$+$N%j%=!<%9$r;He(B
e$B$&$s$G$7$g$&$M$(e(B)e$B$,8z2L$K8+9g$C$F$$$k$N$+e(B

e$B!V%3%9%H$,$+$+$k$+$i@H<e@-$KBP1~$7$J$$!W$H$$$&%]%j%7!<$J$N$G$7$g$&$+e(B?
e$B$$$^$^$G[#Kf$K$J$C$F$$$^$7$?$,!"L@3N$K$9$k$H$$$$$H;W$$$^$9!#e(B
Rubye$B$r:#8e$bMxMQ$7B3$1$F$$$/$+H=CG$9$k$$$$:`NA$K$J$j$^$9$+$i!#e(B
e$BB>$N8@8l%f!<%6$,e(BRubye$B$+$i<+J,$?$A$N;HMQ$7$F$$$k8@8l$r;H$&$h$&4+M6$9$k$J$ie(B
e$B$$$^$,%A%c%s%9$+$b$7$l$^$;$s!#e(B

MoonWolfe$B$G$9!#e(B

Takahiro K. wrote:

e$B$3$l$r2r7h$9$k$K$O!"e(B

  1. e$BJL$K%;%-%e%j%F%#!&%Q%C%A$rI=$9Dj?t$rF3F~$9$k!#Nc$($P!"e(B

CVS::REVISION = ‘2006/11/2 10:10:10’

e$B$H$$$C$?$b$N$rF3F~$9$k!#e(B

e$BJ#?t$N%Q%C%A$r$“$F$k$3$H$b$”$j$($k$N$G!"BP:v$7$?@H<e@-$N<1JL;Re(B(e$B$?$H$($Pe(B
‘CVE-2006-5467’)e$B$NG[Ns$N$[$&$,$$$$$+$b$7$l$^$;$s$M!#e(B

  1. e$B%;%-%e%j%F%#$d4pK\E*$J>c32$@$1$N=$@5$7$+2C$($J$$!"%j%j!<%9e(B(e$B:#2s$G$"e(B
    e$B$l$Pe(B Ruby 1.8.5)e$B$+$i%V%i%s%A$5$;$?=$@5%j%j!<%9MQ$Ne(BCVSe$B%V%i%s%A$r;H$Ce(B
    e$B$F4IM}$9$k!#e(B

e$B%j%j!<%9$H%j%j!<%9$N4V$K%Q%C%A$,J#?tH/@8$7$?$H$-$N$3$H$rA[Dj$9$k$H!"$3$le(B
e$B$,$$$$$h$&$K;W$$$^$9!#e(B

e$B$H$$$C$?!"$3$H$,9M$($i$l$^$9!#e(B

e$B$-$A$s$H9M$($F$/$l$F$"$j$,$H$&$4$6$$$^$9!#e(B

e$B;W9MDd;_$7$F$d$j2a$4$=$&$H$9$k?M$,B?$9$.$^$9!#e(B

1.6.28.16e$B$KBP$9$k%Q%C%A$N$O$:$J$N$K!“e(B1.6.28.17e$B$KBP$9$ke(Bdiffe$B$H$$$&$N$O!“e(B
e$B%Q%C%A$rEv$F$k;~$KIT0B$K$J$j$^$;$s$+e(B?
e$B$H!”$$$&$o$1$G;d$O85!9$=$3$^$Ge(B REVISION e$B$K=E$-$rCV$$$F$$$^$;$s$7!”$=$le(B
e$B$h$j$bJQ99$5$l$?FbMF$r8+$FH=CG$7$^$9!#e(BCVSe$B$N%l%]%8%H%j$G:9J,$r8+$k$3$He(B
e$B$b$G$-$^$9$7!"FC$KIT0B$K$O;W$$$^$;$s!#e(B

e$B;d$N>l9g$O%Q%C%A$N:n@.%_%9$N2DG=@-$r5?$C$F$7$^$$$^$9!#?4G[@-$J$N$G!#e(B
e$B$"$H!“e(Bdiffe$B$@$1$G%Q%C%A$NFbMF$,M}2r$G$-$^$9$+e(B?
e$B$=$s$J<+?.$O;d$K$O$”$j$^$;$s!#e(B
http://www.ruby-lang.org/cgi-bin/cvsweb.cgi/ruby/lib/cgi.rb.diff?r1=1.68;r2=1.68.2.17;f=h
e$B$N$h$&$J%Q%C%A$@$C$?$i$I$&$G$9$+e(B?

MoonWolfe$B$G$9!#e(B

U.Nakamura wrote:

| * e$B%Q%C%A$Ne(Bmd5sume$B$,$J$$!#e(B
| * e$B%Q%C%A$N%%i!<$,$J$$!#e(B
| * cvsweb.cgie$B$K$h$kF0E*$J=PNO$G$O?4$b$H$J$$!#@EE*$J%U%!%$%k$H$7$Fe(B
| e$B$-$A$s$H%
%i!<$5$l$k>l=j$KCV$$$FM_$7$$!#e(B

e$B$4;XE&$O$4$b$C$H$b$J$N$G!"@EE*$J%U%!%$%k$rMQ0U$7$F!“4XO”$9$ke(B
e$B5-=R$r99?7$7$^$7$?!#e(B

e$B%Q%C%A$r:9$7BX$($?$N$@$+$i!“MzNr$r5-=R$7$F$b$i$($k$H$”$j$,$?$$$G$9!#e(B

e$BF|BX$o$j%Q%C%ADj?)$J$s$F?)$Y$?$/$"$j$^$;$se(B^^

In message [email protected]
on Fri, 3 Nov 2006 11:11:53 +0900,
MoonWolf [email protected] wrote:

* e$B%Q%C%A$rEv$F$?%U%!%$%k$Oe(B1.68.2.18e$B$K$J$k$,!"e(BCVSe$B$+$i<hF@$G$-$ke(B
  1.68.2.18e$B$H$O<BBN$,0[$J$ke(B(1.68.2.17e$B$NJQ99$,4^$^$l$F$$$J$$e(B)e$B$N$Ge(B
  e$B:.Mp$N85$G$"$k!#e(B

e$B$=$&$$$&0UL#$G$O!"e(BCGI::REVISIONe$B$OEv$F$K$O$J$i$J$$$H$$$&$3$H$G$9!#e(B

e$B<BBN$,0c$&$N$G$"$l$P!“e(BREVISIONe$B$rJQ$($kI,MW$,$”$k$N$G$Oe(B?
e$B8=>u$Ne(B REVISION
e$B$Oe(BCVSe$B$G%U%!%$%k$r4IM}$7$F$$$k!V5-$7!W$,;D$C$F$$$k$@$1e(B
e$B$G$9!#e(B

1.68.2.17e$B$K$h$k=hM}$N0c$$$r@bL@$9$k$N$K!Ve(B1.68.2.17e$B0J9_!W$H$$$&I=8=$,e(B
e$B$G$-$^$;$s$M!#e(B
e$B$G$-$^$;$s!#e(B

e$BMW$Oe(BCVSe$B$K4IM}$5$l$F$$$k$b$N$H0c$C$?FbMF$K$J$C$?;~E@$G!"0UL#$,$J$/$J$ke(B
e$B$o$1$J$N$G$9!#MM!9$J%Q%C%1!<%8!&%7%9%F%`$GFH<+$K=$@5$r9T$C$F$$$k>l9g$be(B
REVISION e$B$KMj$k$3$H$O$G$-$^$;$s!#e(B

e$B$3$l$r2r7h$9$k$K$O!"e(B

  1. e$BJL$K%;%-%e%j%F%#!&%Q%C%A$rI=$9Dj?t$rF3F~$9$k!#Nc$($P!"e(B

    CVS::REVISION = ‘2006/11/2 10:10:10’

    e$B$H$$$C$?$b$N$rF3F~$9$k!#e(B

e$B%;%-%e%j%F%#$d4pK\E*$J>c32$@$1$N=$@5$7$+2C$($J$$!"%j%j!<%9e(B(e$B:#2s$G$"e(B
e$B$l$Pe(B Ruby
1.8.5)e$B$+$i%V%i%s%A$5$;$?=$@5%j%j!<%9MQ$Ne(BCVSe$B%V%i%s%A$r;H$Ce(B
e$B$F4IM}$9$k!#e(B

e$B$H$$$C$?!"$3$H$,9M$($i$l$^$9!#e(B

e$B%V%i%s%A$N<wL?$O<!$N%j%j!<%9$^$G$H$J$j$^$9$,!"=$@5$9$kFbMF$r8BDj$9$l$P!"e(B
e$B$=$l$[$IJ]<i<+BN$K<j4V$O$+$+$i$J$$$G$7$g$&!#e(B

  • e$B%7%‘%k$,3+J|$5$l$F$$$J$$%5!<%P$@$HBgJQ!#e(B
    e$B%l%s%?%k%5!<%Pe(B? e$B$=$&$$$C$?>l9g$O!"$=$N%5!<%P$G%7%’%k$r;H$($k4IM}<T$,e(B
    e$B$-$A$s$H99?7$9$Y$-$G$O$J$$$N$+$7$ie(B?

e$B<+J,$N<Z$j$F$$$k%5!<%P$G%Q%C%A$,$"$?$C$F$$$k$+<+J,$G3NG’$9$k$3$H$,Fq$7$$e(B
e$B$H$$$&$3$H$G$9!#e(B
e$B$J$k$[$I!#e(B

e$B$$$A$$$A4IM}<T$KLd$$9g$o$;$k$+!“e(BCGI::REVISIONe$B$rI=<($5$;$ke(BCGIe$B$J$I$r:n$C$Fe(B
e$B3NG’$7$J$/$F$O$$$1$^$;$s!#e(B
e$B$=$l$K$7$F$b!”@h$K=q$-$^$7$?$h$&$Ke(BRubye$B$,%Q%C%1!<%8!&%7%9%F%`$G4IM}$5$le(B
e$B$F$$$k>l9g$O!“e(BCGI::REVISIONe$B$GH=CG$G$-$J$$>l9g$O;D$k$N$G!”$=$l$@$1$KMje(B
e$B$k$3$H$O7k6I$G$-$J$$$H;W$$$^$9!#e(B

e$B$*$=$i$/!“:#2s$N%;%-%e%j%F%#$NLdBj$KD>@\4X78$N$J$$!“8_49@-$rB;$J$&62$le(B
e$B$,$”$ke(Bnkfe$B$K4X$9$kJQ99$,e(B1.68.2.17e$B$G9T$o$l$F$$$k$?$a$G$7$g$&!#%;%-%e%j%F%#e(B
e$BBP1~$N%Q%C%A$N$?$a$G$”$l$P!"$A$g$&$Ie(B1.68.2.17e$B$He(B1.68.2.18e$B$N:9J,$G$A$g$&e(B
e$B$INI$$$3$H$K$J$j$^$9!#e(B

1.68.2.17e$B$K$h$kJQ99$,9T$NDI2C!“:o=|$rH<$o$J$$%7%s%W%k$J$b$N$G$”$C$?$+$ie(B
e$BNI$$$b$N$N!"J#;($JJQ99$r$^$?$$$G$$$?$i%Q%C%A$H$7$F$J$j$?$?$J$+$C$?$H$$$&e(B
e$B$3$H$G$9!#e(B
e$B:#2s$O3N$+$K9,1?$G$9!#e(B

e$B8=>u$Ne(B ruby_1_8
e$B$N%V%i%s%A$O!“%;%-%e%j%F%#$J$I$N:GDc8B$N=$@5$r2C$($k$@e(B
e$B$1$N$b$N$G$Oe(B(e$B30Ln$J;d$+$i8+$F$b$=$&$G$Oe(B)e$B$”$j$^$;$s!#$$$o$f$ke(B
stable e$B%P!<e(B
e$B%8%g%s$N!V3+H/MQ%V%i%s%A!W$H$7$+$J$C$F$$$^$;$s!#e(B

e$B$G!“$”$k0J>e!"FCDj$N%;%-%e%j%F%#$NLdBj$KBP$9$k%Q%C%A$rC1=c$Ke(BCVSe$B$NFCDje(B
e$B$N%l%S%8%g%s$N:9J,$GDs6!$9$k$3$H$O85!9:$Fq$J$o$1$G$9!#$3$N$h$&$J>u67$G!“e(B
e$BC1$J$ke(BCVSe$B%l%]%8%H%j$N!V5-$7!W$G$”$ke(BREVISIONe$B$K2?$+$r5a$a$F$bL5BL$G$9!#e(B

1.6.28.16e$B$KBP$9$k%Q%C%A$N$O$:$J$N$K!“e(B1.6.28.17e$B$KBP$9$ke(Bdiffe$B$H$$$&$N$O!“e(B
e$B%Q%C%A$rEv$F$k;~$KIT0B$K$J$j$^$;$s$+e(B?
e$B$H!”$$$&$o$1$G;d$O85!9$=$3$^$Ge(B REVISION
e$B$K=E$-$rCV$$$F$$$^$;$s$7!”$=$le(B
e$B$h$j$bJQ99$5$l$?FbMF$r8+$FH=CG$7$^$9!#e(BCVSe$B$N%l%]%8%H%j$G:9J,$r8+$k$3$He(B
e$B$b$G$-$^$9$7!"FC$KIT0B$K$O;W$$$^$;$s!#e(B

e$B$3$s$K$A$O!"$J$+$`$ie(B(e$B$&e(B)e$B$G$9!#e(B

In message “[ruby-dev:29756] Re: cgi.rbe$B$Ne(BDoSe$B@H<e@-$K$D$$$Fe(B”
on Nov.03,2006 14:53:52, [email protected] wrote:
| e$B$“$H!”%W%m%0%i%`E*$K3NG’$9$k$3$H$@$1$G$O$J$/?M4V$,3NG’$7$F0B?4$9$k$?$a$Ne(B
| e$B<jCJ$rMQ0U$7$FM_$7$$$H$$$&$3$H$,;d$N<q;]$G$9!#e(B

(1)e$B$,%9%k!<$5$l$F$^$9$,!“$o$+$k?M$K3NG’$9$k!”$H$$$&A*Br;h$O$"e(B
e$B$j$($J$$$N$G$7$g$&$+e(B?

| e$B%Q%C%A$r$“$F$F$b!”@H<e@-$NB8:_$9$k!V%P!<%8%g%se(B1.8.5e$B0JA0!W$N$^$^$G$"$Ce(B
| e$B$F!"K\Ev$KBP:v$G$-$?$N$+H=CG$G$-$^$;$s$,$=$l$G$b$$$$$He(B?

e$B!VK\Ev$KBP:v$G$-$?$N$+!W$O!"<B:]$K$=$N@H<e@-$,:F8=$9$k$+$I$&e(B
e$B$+$r3NG’$9$k0J30$KH=CGIT2DG=$@$H;W$$$^$9$,e(B…

| > (3) e$B$b$7e(BCGI::REVISIONe$B$,E,@Z$G$J$$$H$7$?$i!“$I$N$h$&$J<jCJ$,E,e(B
| > e$B@Z$H9M$($i$l$k$+e(B
|
| [ruby-dev:29726]e$B$G$Oe(B(a)e$B$H$7$Fe(BRubye$B<+BN$N%P!<%8%g%s$r$”$2$k$H$$$&e(B
| e$BJL$NABr;h$bDs<($7$F$$$^$9!#e(B
| e$B$9$G$KA
Br;h$,Ds<($5$l$F$$$k$K$b4X$o$i$:!“$3$N$h$&$J=q$-J}$r$9$k$N$Oe(B
| e$B%U%'%”$G$O$"$j$^$;$s!#e(B

e$B$J$s$@$+8m2r$,$"$k$h$&$G$9$,!“e(B
(1)e$B$G=q$$$?I,A3@-$,$J$$$J$i$=$b$=$b$3$NOC$OITMWe(B
(1)e$B$G=q$$$?I,A3@-$,$”$k$J$i!“e(B(2)e$B$N3NG’$,I,MWe(B
(2)e$B$GE,@Z$G$J$$$J$ie(B(3)e$B$N8!F$$,I,MWe(B
e$B$H$$$&!”;d$+$i$9$k$H$4$/Ev$?$jA0$N;W9M=g=x$rDs<($7$?$@$1$G$9e(B
e$B$h!#e(B

e$B;d$Oe(B(1)e$B!Ae(B(4)e$B$N$$$:$l$K$D$$$F$b:Y$+$/8!F$$7$?$$>u67$K:#$O$$$Je(B
e$B$$$N$G!“8e$OI,MW@-$,$”$k$H46$8$k?M$K$G$$;$7$^$9$,!"$3$l$/$ie(B
e$B$$8!F$$7$F=i$a$F!V$8$c$"e(BCGI::REVISIONe$B$r$3$&$7$^$7$g$&!W$H$+!“e(B
e$B!Ve(Bruby
-ve$B$N=PNO$rJQ$($^$7$g$&!W$H$+!”!V%7%9%F%`4IM}<T$KJ9$1$Pe(B
e$B=
$o$j$@$+$i$I$&$G$b$$$$!W$H$+!“$^$”$I$s$J$N$K$J$k$+$o$+$s$Je(B
e$B$$$G$9$,$I$C$+E,@Z$J7kO@$KE~C#$9$k$N$G$O$J$$$G$7$g$&$+!#e(B
MoonWolfe$B$5$s$,0U8+$r=P$7$?$N$O8+$^$7$?$78!F$$KCM$9$k$H;W$$$^e(B
e$B$9$N$G!"$=$N!V8!F$!W$r$7$F$I$&$9$k$+7h$a$J$$$H$$$1$J$$$h$M!"e(B
e$B$H8@$C$F$$$k$D$b$j$G$9!#e(B

| e$B$3$N$^$^C/$b0U8+$r=P$5$:$K%U%'!<%I%"%&%H$5$;$?$$$N$G$9$+e(B?

e$B5U$G$9!#e(B
e$BI,MW$J$i!“B>$K$b$C$H$$$$0F$,$J$$$+$b8!F$$7$F$M!”$H8@$C$F$k$Ne(B
e$B$G$9!#e(B
e$B$@$+$i!“$$$i$sN"FI$_$H$+$7$J$$$G!”$,$s$,$s5DO@$7$F$/$@$5$$!#e(B

| > (4) e$B0J>e$rF’$^$($?>e$G!"$=$l$K$+$+$k%3%9%He(B(e$BC/$+$N%j%=!<%9$r;He(B
| > e$B$&$s$G$7$g$&$M$(e(B)e$B$,8z2L$K8+9g$C$F$$$k$N$+e(B
|
| e$B!V%3%9%H$,$+$+$k$+$i@H<e@-$KBP1~$7$J$$!W$H$$$&%]%j%7!<$J$N$G$7$g$&$+e(B?

e$B$“$N$G$9$M!”!V%3%9%H$,$+$+$k$+$i@H<e@-$KBP1~$7$J$$!W$J$s$F;de(B
e$B$O0l8@$b8@$C$F$$$^$;$s!#e(B
e$B:#2sJs9p$5$l$F$$$k@H<e@-$K$D$$$F$O!"%3%9%H$b%/%=$b!"4{$KBP1~e(B
e$B$5$l$F$$$k$o$1$G$9!#e(B

e$B:#OC$7$F$$$k$N$O!“@H<e@-$NBP1~0lHL$NOC$G$b!”:#2s$N@H<e@-$KBPe(B
e$B1~$9$k$+$I$&$+$G$b$J$/!“!V%Q%C%A$,$”$?$C$F$$$k$+3NG’$9$kJ}K!e(B
e$B$H$7$Fe(BCGI::REVISIONe$B$r;29M$K$G$-$J$$!W$H$$$&e(BMoonWolfe$B$5$s$N$4;Xe(B
e$BE&$K$D$$$F$G$9!#e(B
e$B$4M}2r$7$F$$$?$@$1$^$9$+e(B?

Rubye$B$N@H<e@-$KBP$9$kBP1~A4HL$K$D$$$F$N0l4S$7$?%]%j%7!<$K$D$$e(B
e$B$F$O!“;d$K$O$=$l$r8l$k5$$O$”$j$^$;$s!#$@$C$FCN$i$J$$$7!#e(B

e$B$=$l$G$O!#e(B

In message [email protected]
on Fri, 3 Nov 2006 15:16:40 +0900,
MoonWolf [email protected] wrote:

  1. e$BJL$K%;%-%e%j%F%#!&%Q%C%A$rI=$9Dj?t$rF3F~$9$k!#Nc$($P!"e(B

    CVS::REVISION = ‘2006/11/2 10:10:10’

    e$B$H$$$C$?$b$N$rF3F~$9$k!#e(B

e$BJ#?t$N%Q%C%A$r$“$F$k$3$H$b$”$j$($k$N$G!“BP:v$7$?@H<e@-$N<1JL;Re(B(e$B$?$H$($Pe(B
‘CVE-2006-5467’)e$B$NG[Ns$N$[$&$,$$$$$+$b$7$l$^$;$s$M!#e(B
e$B$”$^$jJ#;($K$;$:!“2?;~$N;~E@$N%b%N$+$o$+$k!V5-$7!W$@$1$K$7$F!”$=$3$^$Ge(B
e$B$G2?$,D>$C$F$$$k$+$H$$$C$?>pJs$OJL$Ne(BWebe$B%Z!<%8$J$j!"%I%-%e%a%s%H$J$j$Ke(B
e$BJ,$1$F$*$$$?J}$,3Z$@$H;W$$$^$9!#e(B

e$B$?$@!"$3$l$r9T$&$?$a$K$b7k6I$O!"e(B

  1. e$B%;%-%e%j%F%#$d4pK\E*$J>c32$@$1$N=$@5$7$+2C$($J$$!"%j%j!<%9e(B(e$B:#2s$G$"e(B
    e$B$l$Pe(B Ruby 1.8.5)e$B$+$i%V%i%s%A$5$;$?=$@5%j%j!<%9MQ$Ne(BCVSe$B%V%i%s%A$r;H$Ce(B
    e$B$F4IM}$9$k!#e(B
    e$B$3$C$A$,I,MW$K$J$k$+$H;W$$$^$9!#e(B

1.6.28.16e$B$KBP$9$k%Q%C%A$N$O$:$J$N$K!“e(B1.6.28.17e$B$KBP$9$ke(Bdiffe$B$H$$$&$N$O!“e(B
e$B%Q%C%A$rEv$F$k;~$KIT0B$K$J$j$^$;$s$+e(B?
e$B$H!”$$$&$o$1$G;d$O85!9$=$3$^$Ge(B REVISION e$B$K=E$-$rCV$$$F$$$^$;$s$7!”$=$le(B
e$B$h$j$bJQ99$5$l$?FbMF$r8+$FH=CG$7$^$9!#e(BCVSe$B$N%l%]%8%H%j$G:9J,$r8+$k$3$He(B
e$B$b$G$-$^$9$7!"FC$KIT0B$K$O;W$$$^$;$s!#e(B

e$B;d$N>l9g$O%Q%C%A$N:n@.%%9$N2DG=@-$r5?$C$F$7$^$$$^$9!#?4G[@-$J$N$G!#e(B
e$B7+$jJV$7$^$9$,!“e(BCVSe$B$K%;%-%e%j%F%#=$@5MQ$N@lMQ$N%V%i%s%A$G$J$$8B$j!”%le(B
e$B%S%8%g%s$r85$K$7$?e(Bcvs
diffe$B$N7k2L$@$+$i0B?4$H$$$&$3$H$K$O$J$i$:!"%Q%C%Ae(B
e$B$N:n@.%
%9$N2DG=@-$r5?$($P!“$-$j$O$”$j$^$;$s!#e(B

e$B$"$H!“e(Bdiffe$B$@$1$G%Q%C%A$NFbMF$,M}2r$G$-$^$9$+e(B? e$B$=$s$J<+?.$O;d$K$O$”$j$^$;$s!#e(B
e$B%1!<%9e(B by e$B%1!<%9$G$9$,!"e(B

http://www.ruby-lang.org/cgi-bin/cvsweb.cgi/ruby/lib/cgi.rb.diff?r1=1.68;r2=1.68.2.17;f=h
e$B$N$h$&$J%Q%C%A$@$C$?$i$I$&$G$9$+e(B?
e$B$3$l$O7y$G$9!#e(B

e$B?"ED$H?=$7$^$9!#e(B

e$B!!$I$3$K$D$J$2$k$Y$-$+J,$+$i$J$+$C$?$N$G!"$H$j$"$($:$3$A$i$K!#e(B

e$B5-=R$r99?7$7$^$7$?!#e(B
e$B!!e(Bhttp://www.ruby-lang.org/ja/downloads/ e$B$G8x3+$5$l$F$$$ke(B
1.8.5 e$B$N%=!<%9e(B
e$B%3!<%I$N%"!<%+%$%VB>$K4X$7$F$O$I$&$9$k$N$G$7$g$&$+!)e(B

ftp://ftp.ruby-lang.org/pub/ruby/ruby-1.8.5.tar.gz

e$B$3$N%"!<%+%$%V$Oe(B 11/3 22:44 e$B8=:_!"@H<e@-$r4^$s$@e(B lib/cgi.rb
e$B$rF1:-$7$F$$e(B
e$B$^$9!#e(B

ftp://ftp.ruby-lang.org/pub/ruby/stable-snapshot.tar.gz

e$B$3$A$i$O0BDjHG%9%J%C%W%7%g%C%H!"$H$$$&$3$H$G@H<e@-$NBP1~$O$J$5$l$F$$$k$he(B
e$B$&$G$9!#e(B

e$B!!$3$l$+$ie(B 1.8.5 e$B4D6-$r;H$&%f!<%6$KBP$7$F@H<e@-$,;D$C$F$$$ke(B
ruby-1.8.5.tar.gz e$B$r%@%&%s%m!<%I$7!"%Q%C%A$rEv$F$Fe(B…
e$B$H$$$&:n6H$r$5$;$ke(B
e$B$K$7$F$b!"%@%&%s%m!<%I%Z!<%8$K$O$=$N$h$&$JJ88@$,$"$j$^$;$s!#e(B

e$B!!$^$?0BDjHG%9%J%C%W%7%g%C%H$Oe(B 1.8.5
e$B$N%j%j!<%9;~$N%3!<%I$+$i$+$J$j$NJQe(B
e$B99$,2C$o$C$F$$$k$h$&$G$9$N$G!"!Ve(B1.8.5
e$B$G$O$J$/0BDjHG$r%@%&%s%m!<%I$7$F$/e(B
e$B$@$5$$!W$H$$$&$N$bFq$7$=$&$G$9!#e(B

% diff -ru ruby-1.8.5 ruby | wc -l
45484

e$B!!$3$N$^$^$@$H?75,$Ke(B 1.8.5
e$B$r;HMQ$7$h$&$H$9$k?M$,:.Mp$7$=$&$J$N$G!"e(B
1.8.5.1
e$B$J$I@H<e@-$r=$@5$7$?%P!<%8%g%s$r=P$9$3$H$O$G$-$J$$$N$G$7$g$&$+!)e(B

e$B!!$J$*e(B 1.8.5.1 e$B$,IT2D$N>l9g$G$b!“e(B1.8.5
e$B$N%”!<%+%$%VCf$Ne(B lib/cgi.rb e$B$r:9e(B
e$B$7BX$($F$=$N$^$^e(B ruby-1.8.5.tar.gz e$B$H$7$F=P$9$N$O!"e(BFreeBSD
e$B$Ne(B ports e$B%7%9e(B
e$B%F%`$J$I$r9M$($k$HHr$1$F$$$?$@$-$?$$$H;W$$$^$9!#e(B

e$B$^$D$b$He(B e$B$f$-$R$m$G$9e(B

In message “Re: [ruby-dev:29761] Re:
cgi.rbe$B$Ne(BDoSe$B@H<e@-$K$D$$$Fe(B”
on Fri, 3 Nov 2006 23:06:22 +0900, e$B?"EDe(B e$BM5G7e(B
[email protected] writes:

|e$B!!$3$l$+$ie(B 1.8.5 e$B4D6-$r;H$&%f!<%6$KBP$7$F@H<e@-$,;D$C$F$$$ke(B
|ruby-1.8.5.tar.gz e$B$r%@%&%s%m!<%I$7!“%Q%C%A$rEv$F$Fe(B… e$B$H$$$&:n6H$r$5$;$ke(B
|e$B$K$7$F$b!”%@%&%s%m!<%I%Z!<%8$K$O$=$N$h$&$JJ88@$,$"$j$^$;$s!#e(B

e$B0lHV:G=i$K=R$Y$?DL$j!“e(BDoSe$B@H<e@-$OM%@hEY$,Dc$$$N$G$3$N$h$&$Je(B
e$BBP1~$O$H$i$J$/$F$b$@$$$8$g$&$V$+$J!”$H9M$($F$$$^$9!#$h$j=EBge(B
e$B$JLdBj$,H/@8$9$l$P!"e(B1.8.6e$B$r=P$7$^$9!#e(B

In message [email protected]
on Fri, 3 Nov 2006 23:06:22 +0900,
e$B?"EDe(B e$BM5G7e(B [email protected] wrote:

e$B!!e(Bhttp://www.ruby-lang.org/ja/downloads/ e$B$G8x3+$5$l$F$$$ke(B 1.8.5 e$B$N%=!<%9e(B
e$B%3!<%I$N%"!<%+%$%VB>$K4X$7$F$O$I$&$9$k$N$G$7$g$&$+!)e(B

ftp://ftp.ruby-lang.org/pub/ruby/ruby-1.8.5.tar.gz

e$B$3$N%“!<%+%$%V$Oe(B 11/3 22:44 e$B8=:_!”@H<e@-$r4^$s$@e(B lib/cgi.rb e$B$rF1:-$7$F$$e(B
e$B$^$9!#e(B
ftp://ftp.ruby-lang.org/pub/ruby/patches/ruby-1.8.5-cgi-dos-1.patch

e$B$H$$$C$?$b$N$,:GDc8BMQ0U$7$F$"$C$?J}$,NI$$$H;W$$$^$9!#%G%#%l%/%H%[email protected](B
e$B$d%U%!%$%k$NL>A0$N$D$1J}Ey$O5DO@$NM>CO$O;D$k$H;W$$$^$9!#e(B

e$B!!$3$N$^$^$@$H?75,$Ke(B 1.8.5 e$B$r;HMQ$7$h$&$H$9$k?M$,:.Mp$7$=$&$J$N$G!"e(B
1.8.5.1 e$B$J$I@H<e@-$r=$@5$7$?%P!<%8%g%s$r=P$9$3$H$O$G$-$J$$$N$G$7$g$&$+!)e(B
e$BJL$N8uJd$H$7$F$O!"e(B1.8.5ae$B$H$$$C$?L>A0$G$7$g$&$+!#e(B

e$B!!$J$*e(B 1.8.5.1 e$B$,IT2D$N>l9g$G$b!“e(B1.8.5 e$B$N%”!<%+%$%VCf$Ne(B lib/cgi.rb e$B$r:9e(B
e$B$7BX$($F$=$N$^$^e(B ruby-1.8.5.tar.gz e$B$H$7$F=P$9$N$O!"e(BFreeBSD e$B$Ne(B ports e$B%7%9e(B
e$B%F%`$J$I$r9M$($k$HHr$1$F$$$?$@$-$?$$$H;W$$$^$9!#e(B
e$BF146$G$9!#e(B