[Security] Ruby 1.9.1-p429 is out

Ruby
1

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

Ruby 1.9.1-p429 has just been released. This is a patchlevel release for
Ruby 1.9.1. This fixes many bugs and includes the fix for a security
vulnerability that allows an attacker to execute an arbitrary code.

See http://svn.ruby-lang.org/repos/ruby/tags/v1_9_1_429/ChangeLog for
other fixes.

== Vunerability
A security vulnerability that causes buffer overflow when you assign a
danger value to ARGF.inplace_mode on Windows. It possibly allows an
attacker to execute an arbitrary code.

The affected versions are:

  • Ruby 1.9.1 patchlevel 378 and all prior versions.
  • Ruby 1.9.2 preview 3 and all prior versions.
  • Development versions of Ruby 1.9 (1.9.3dev).
    I recommend you to upgrade your ruby 1.9 to 1.9.1-p429 or
    1.9.2-preview3.

The vulnerability does not directly affect to Ruby 1.8 series.

=== Credit
The vulnerability was found and reported by Masaya TARUI.

== Location

iEYEARECAAYFAkwtxikACgkQOXzH5JLb/AWOawCfd1iGdmbzhcxwXfEwSSF0GQl5
8IwAnjaOe4zU/E0qYTixgxOT7zD026OH
=Xqbg
-----END PGP SIGNATURE-----

2

(2010/07/02 19:57), Yuki S. (Yugui) wrote:

The vulnerability does not directly affect to Ruby 1.8 series.

Let me tell you a bit more about it. This bug does exist on 1.8, but it
lacks
ARGF.inplace_mode. So an attacker should instead utilize ruby’s -i
option
like this:
ruby.exe -i? VULNERABLE.rb %VICTIMPATH%

Of course this means the attacker has not only gained privileges to
write
files but are also able to spawn arbitrary process; which means the
system
has already been cracked.

So we don’t think 1.8 situation itself is a security issue. We are
handling
this as a normal bug.

3

Yuki S. (Yugui):

The affected versions are:

  • Ruby 1.9.1 patchlevel 378 and all prior versions.
  • Ruby 1.9.2 preview 3 and all prior versions.
  • Development versions of Ruby 1.9 (1.9.3dev).
    I recommend you to upgrade your ruby 1.9 to 1.9.1-p429 or 1.9.2-preview3.

Given that 1.9.2-preview3 is vulnerable,
should the last recommendation say 1.9.2-RC1?

— Piotr S.