# RubyGems 0.9.0 and earlier installation exploit

**URL:** <https://www.ruby-forum.com/t/rubygems-0-9-0-and-earlier-installation-exploit/102648>\
**Category:** Ruby\
**Created:** [January 17, 2007, 12:45am UTC](https://www.ruby-forum.com/t/rubygems-0-9-0-and-earlier-installation-exploit/102648 "2007-01-17T00:45:17Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![miracleofmagick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/71c47a/32.png) [@miracleofmagick](https://www.ruby-forum.com/u/miracleofmagick)\
**Post date:** [January 17, 2007, 12:45am UTC](https://www.ruby-forum.com/t/rubygems-0-9-0-and-earlier-installation-exploit/102648/1 "2007-01-17T00:45:17Z")

</div>

Problem Description:

RubyGems does not check installation paths for gems before writing  
files.

Impact:

Since RubyGems packages are typically installed using root  
permissions, arbitrary files may be overwritten on-disk. This may  
lead to denial of service, privilege escalation or remote compromise.

Workaround:

No known workarounds

Solution:

a) Upgrade to RubyGems 0.9.1

b) Apply one of the following patches

For RubyGems 0.9.0: