forked from ruby/www.ruby-lang.org
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
12 changed files
with
424 additions
and
0 deletions.
There are no files selected for viewing
36 changes: 36 additions & 0 deletions
36
en/news/_posts/2018-03-28-buffer-under-read-unpack-cve-2018-8778.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| --- | ||
| layout: news_post | ||
| title: "CVE-2018-8778: Buffer under-read in String#unpack" | ||
| author: "usa" | ||
| date: 2018-03-28 14:00:00 +0000 | ||
| tags: security | ||
| lang: en | ||
| --- | ||
|
|
||
| There is a buffer under-read vulnerability in `String#unpack` method. | ||
| This vulnerability has been assigned the CVE identifier [CVE-2018-8778](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8778). | ||
|
|
||
| ## Details | ||
|
|
||
| `String#unpack` receives format specifiers as its parameter, and can be specified the position of parsing the data by the specifier `@`. | ||
| If a big number is passed with `@`, the number is treated as the negative value, and out-of-buffer read is occurred. | ||
| So, if a script accepts an external input as the argument of `String#unpack`, the attacker can read data on heaps. | ||
|
|
||
| All users running an affected release should upgrade immediately. | ||
|
|
||
| ## Affected Versions | ||
|
|
||
| * Ruby 2.2 series: 2.2.9 and earlier | ||
| * Ruby 2.3 series: 2.3.6 and earlier | ||
| * Ruby 2.4 series: 2.4.3 and earlier | ||
| * Ruby 2.5 series: 2.5.0 and earlier | ||
| * Ruby 2.6 series: 2.6.0-preview1 | ||
| * prior to trunk revision r62992 | ||
|
|
||
| ## Credit | ||
|
|
||
| Thanks to [aerodudrizzt](https://hackerone.com/aerodudrizzt) for reporting the issue. | ||
|
|
||
| ## History | ||
|
|
||
| * Originally published at 2018-03-28 14:00:00 (UTC) |
34 changes: 34 additions & 0 deletions
34
en/news/_posts/2018-03-28-http-response-splitting-in-webrick-cve-2017-17742.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| --- | ||
| layout: news_post | ||
| title: "CVE-2017-17742: HTTP response splitting in WEBrick" | ||
| author: "usa" | ||
| date: 2018-03-28 14:00:00 +0000 | ||
| tags: security | ||
| lang: en | ||
| --- | ||
|
|
||
| There is an HTTP response splitting vulnerability in WEBrick bundled with Ruby. | ||
| This vulnerability has been assigned the CVE identifier [CVE-2017-17742](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17742). | ||
|
|
||
| ## Details | ||
|
|
||
| If a script accepts an external input and outputs it without modification as a part of HTTP responses, an attacker can use newline characters to deceive the clients that the HTTP response header is stopped at there, and can inject fake HTTP responses after the newline characters to show malicious contents to the clients. | ||
|
|
||
| All users running an affected release should upgrade immediately. | ||
|
|
||
| ## Affected Versions | ||
|
|
||
| * Ruby 2.2 series: 2.2.9 and earlier | ||
| * Ruby 2.3 series: 2.3.6 and earlier | ||
| * Ruby 2.4 series: 2.4.3 and earlier | ||
| * Ruby 2.5 series: 2.5.0 and earlier | ||
| * Ruby 2.6 series: 2.6.0-preview1 | ||
| * prior to trunk revision r62968 | ||
|
|
||
| ## Credit | ||
|
|
||
| Thanks to Aaron Patterson <tenderlove@ruby-lang.org> for reporting the issue. | ||
|
|
||
| ## History | ||
|
|
||
| * Originally published at 2018-03-28 14:00:00 (UTC) |
34 changes: 34 additions & 0 deletions
34
en/news/_posts/2018-03-28-large-request-dos-in-webrick-cve-2018-8777.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| --- | ||
| layout: news_post | ||
| title: "CVE-2018-8777: DoS by large request in WEBrick" | ||
| author: "usa" | ||
| date: 2018-03-28 14:00:00 +0000 | ||
| tags: security | ||
| lang: en | ||
| --- | ||
|
|
||
| There is a out-of-memory DoS vulnerability with a large request in WEBrick bundled with Ruby. | ||
| This vulnerability has been assigned the CVE identifier [CVE-2018-8777](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8777). | ||
|
|
||
| ## Details | ||
|
|
||
| If an attacker sends a large request which contains huge HTTP headers, WEBrick try to process it on memory, so the request causes the out-of-memory DoS attack. | ||
|
|
||
| All users running an affected release should upgrade immediately. | ||
|
|
||
| ## Affected Versions | ||
|
|
||
| * Ruby 2.2 series: 2.2.9 and earlier | ||
| * Ruby 2.3 series: 2.3.6 and earlier | ||
| * Ruby 2.4 series: 2.4.3 and earlier | ||
| * Ruby 2.5 series: 2.5.0 and earlier | ||
| * Ruby 2.6 series: 2.6.0-preview1 | ||
| * prior to trunk revision r62965 | ||
|
|
||
| ## Credit | ||
|
|
||
| Thanks to Eric Wong <e@80x24.org> for reporting the issue. | ||
|
|
||
| ## History | ||
|
|
||
| * Originally published at 2018-03-28 14:00:00 (UTC) |
36 changes: 36 additions & 0 deletions
36
en/news/_posts/2018-03-28-poisoned-nul-byte-dir-cve-2018-8780.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| --- | ||
| layout: news_post | ||
| title: "CVE-2018-8779: Unintentional directory traversal by poisoned NUL byte in Dir" | ||
| author: "usa" | ||
| date: 2018-03-28 14:00:00 +0000 | ||
| tags: security | ||
| lang: en | ||
| --- | ||
|
|
||
| There is an unintentional directory traversal in some methods in `Dir`. | ||
| This vulnerability has been assigned the CVE identifier [CVE-2018-8779](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8779). | ||
|
|
||
| ## Details | ||
|
|
||
| `Dir.open`, `Dir.new`, `Dir.entries` and `Dir.empty?` accept the path of the target directory as their parameter. | ||
| If the parameter contains NUL (`\0`) bytes, these methods recognize that the path is completed before the NUL bytes. | ||
| So, if a script accepts an external input as the argument of these methods, the attacker can make the unintentional directory traversal. | ||
|
|
||
| All users running an affected release should upgrade immediately. | ||
|
|
||
| ## Affected Versions | ||
|
|
||
| * Ruby 2.2 series: 2.2.9 and earlier | ||
| * Ruby 2.3 series: 2.3.6 and earlier | ||
| * Ruby 2.4 series: 2.4.3 and earlier | ||
| * Ruby 2.5 series: 2.5.0 and earlier | ||
| * Ruby 2.6 series: 2.6.0-preview1 | ||
| * prior to trunk revision r62989 | ||
|
|
||
| ## Credit | ||
|
|
||
| Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for reporting the issue. | ||
|
|
||
| ## History | ||
|
|
||
| * Originally published at 2018-03-28 14:00:00 (UTC) |
39 changes: 39 additions & 0 deletions
39
en/news/_posts/2018-03-28-poisoned-nul-byte-unixsocket-cve-2018-8779.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| --- | ||
| layout: news_post | ||
| title: "CVE-2018-8780: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket" | ||
| author: "usa" | ||
| date: 2018-03-28 14:00:00 +0000 | ||
| tags: security | ||
| lang: en | ||
| --- | ||
|
|
||
| There is a unintentional socket creation vulnerability in `UNIXServer.open` method of socket library bundled with Ruby. | ||
| And there is also a unintentional socket access vulnerability in `UNIXSocket.open` method. | ||
| This vulnerability has been assigned the CVE identifier [CVE-2018-8780](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8780). | ||
|
|
||
| ## Details | ||
|
|
||
| `UNIXServer.open` accepts the path of the socket to be created at the first parameter. | ||
| If the path contains NUL (`\0`) bytes, this method recognize that the path is completed before the NUL bytes. | ||
| So, if a script accepts an external input as the argument of this method, the attacker can make the socket file in the unintentional path. | ||
| And, `UNIXSocket.open` also accepts the path of the socket to be created at the first parameter without checking NUL bytes like `UNIXServer.open`. | ||
| So, if a script accepts an external input as the argument of this method, the attacker can accepts the socket file in the unintentional path. | ||
|
|
||
| All users running an affected release should upgrade immediately. | ||
|
|
||
| ## Affected Versions | ||
|
|
||
| * Ruby 2.2 series: 2.2.9 and earlier | ||
| * Ruby 2.3 series: 2.3.6 and earlier | ||
| * Ruby 2.4 series: 2.4.3 and earlier | ||
| * Ruby 2.5 series: 2.5.0 and earlier | ||
| * Ruby 2.6 series: 2.6.0-preview1 | ||
| * prior to trunk revision r62991 | ||
|
|
||
| ## Credit | ||
|
|
||
| Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for reporting the issue. | ||
|
|
||
| ## History | ||
|
|
||
| * Originally published at 2018-03-28 14:00:00 (UTC) |
37 changes: 37 additions & 0 deletions
37
...tentional-file-and-directory-creation-with-directory-traversal-cve-2018-6914.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| --- | ||
| layout: news_post | ||
| title: "CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir" | ||
| author: "usa" | ||
| date: 2018-03-28 14:00:00 +0000 | ||
| tags: security | ||
| lang: en | ||
| --- | ||
|
|
||
| There is an unintentional directory creation vulnerability in tmpdir library bundled with Ruby. | ||
| And there is also an unintentional file creation vulnerability in tempfile library bundled with Ruby, because it uses tmpdir internally. | ||
| This vulnerability has been assigned the CVE identifier [CVE-2018-6914](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6914). | ||
|
|
||
| ## Details | ||
|
|
||
| `Dir.mktmpdir` method introduced by tmpdir library accepts the prefix and the suffix of the directory which is created as the first parameter. | ||
| The prefix can contain relative directory specifiers `"../"`, so this method can be used to target any directory. | ||
| So, if a script accepts an external input as the prefix, and the targeted directory has inappropriate permissions or the ruby process has inappropriate privileges, the attacker can create a directory or a file at any directory. | ||
|
|
||
| All users running an affected release should upgrade immediately. | ||
|
|
||
| ## Affected Versions | ||
|
|
||
| * Ruby 2.2 series: 2.2.9 and earlier | ||
| * Ruby 2.3 series: 2.3.6 and earlier | ||
| * Ruby 2.4 series: 2.4.3 and earlier | ||
| * Ruby 2.5 series: 2.5.0 and earlier | ||
| * Ruby 2.6 series: 2.6.0-preview1 | ||
| * prior to trunk revision r62990 | ||
|
|
||
| ## Credit | ||
|
|
||
| Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for reporting the issue. | ||
|
|
||
| ## History | ||
|
|
||
| * Originally published at 2018-03-28 14:00:00 (UTC) |
35 changes: 35 additions & 0 deletions
35
ja/news/_posts/2018-03-28-buffer-under-read-unpack-cve-2018-8778.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| --- | ||
| layout: news_post | ||
| title: "CVE-2018-8778: String#unpack における範囲外読み込みの脆弱性について" | ||
| author: "usa" | ||
| date: 2018-03-28 14:00:00 +0000 | ||
| tags: security | ||
| lang: ja | ||
| --- | ||
|
|
||
| Ruby の組み込みクラス `String` のメソッド `String#unpack` において、攻撃者により配列の範囲外へのアクセスが可能となりうる脆弱性が発見されました。 | ||
| この脆弱性は、[CVE-2018-8778](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8778) として登録されています。 | ||
|
|
||
| ## 詳細 | ||
|
|
||
| 組み込みクラス `String` のメソッド `String#unpack` では、引数でフォーマット指定子を与えますが、位置指定子 `@` によって指定した位置のデータを読み込むことができます。この際、位置指定として巨大な整数を与えた場合、内部処理的に負数とみなされて、文字列の範囲外のデータにアクセスできてしまっていました。 | ||
| このため、外部の入力を `String#unpack` の引数として指定可能な場合、攻撃者によってヒープ上の領域が読み込み可能となっていました。 | ||
|
|
||
| この問題の影響を受けるバージョンの Ruby のユーザーは、速やかに問題の修正されたバージョンに更新してください。 | ||
|
|
||
| ## 影響を受けるバージョン | ||
|
|
||
| * Ruby 2.2.9 以前の全ての Ruby 2.2 系列 | ||
| * Ruby 2.3.6 以前の全ての Ruby 2.3 系列 | ||
| * Ruby 2.4.3 以前の全ての Ruby 2.4 系列 | ||
| * Ruby 2.5.0 | ||
| * Ruby 2.6.0-preview1 | ||
| * revision 62992 より前の開発版 | ||
|
|
||
| ## クレジット | ||
|
|
||
| この脆弱性情報は、[aerodudrizzt](https://hackerone.com/aerodudrizzt) 氏によって報告されました。 | ||
|
|
||
| ## 更新履歴 | ||
|
|
||
| * 2018-03-28 23:00:00 (JST) 初版 |
34 changes: 34 additions & 0 deletions
34
ja/news/_posts/2018-03-28-http-response-splitting-in-webrick-cve-2017-17742.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| --- | ||
| layout: news_post | ||
| title: "CVE-2017-17742: WEBrick における HTTP レスポンス偽装の脆弱性について" | ||
| author: "usa" | ||
| date: 2018-03-28 14:00:00 +0000 | ||
| tags: security | ||
| lang: ja | ||
| --- | ||
|
|
||
| Ruby の標準添付ライブラリである WEBrick で、攻撃者により偽の HTTP レスポンス生成を許してしまう脆弱性が発見されました。 | ||
| この脆弱性は、[CVE-2017-17742](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17742) として登録されています。 | ||
|
|
||
| ## 詳細 | ||
|
|
||
| 標準添付ライブラリ WEBrick において、外部からの入力をそのまま HTTP レスポンスの一部として出力するようなスクリプトで利用していた場合、そうした入力中に改行文字を含めることによって、あたかもその HTTP レスポンスがそこで打ち切られたかのように振る舞わせた上で、以降に任意の HTTP レスポンスを出力させることによって、悪意ある内容を利用者に閲覧させることが可能となっていました。 | ||
|
|
||
| この問題の影響を受けるバージョンの Ruby のユーザーは、速やかに問題の修正されたバージョンに更新してください。 | ||
|
|
||
| ## 影響を受けるバージョン | ||
|
|
||
| * Ruby 2.2.9 以前の全ての Ruby 2.2 系列 | ||
| * Ruby 2.3.6 以前の全ての Ruby 2.3 系列 | ||
| * Ruby 2.4.3 以前の全ての Ruby 2.4 系列 | ||
| * Ruby 2.5.0 | ||
| * Ruby 2.6.0-preview1 | ||
| * revision 62968 より前の開発版 | ||
|
|
||
| ## クレジット | ||
|
|
||
| この脆弱性情報は、Aaron Patterson 氏 <tenderlove@ruby-lang.org>によって報告されました。 | ||
|
|
||
| ## 更新履歴 | ||
|
|
||
| * 2018-03-28 23:00:00 (JST) 初版 |
34 changes: 34 additions & 0 deletions
34
ja/news/_posts/2018-03-28-large-request-dos-in-webrick-cve-2018-8777.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| --- | ||
| layout: news_post | ||
| title: "CVE-2018-8777: WEBrick における巨大リクエストにともなう DoS 脆弱性について" | ||
| author: "usa" | ||
| date: 2018-03-28 14:00:00 +0000 | ||
| tags: security | ||
| lang: ja | ||
| --- | ||
|
|
||
| Ruby の標準添付ライブラリである WEBrick で、攻撃者により巨大なリクエストが送信された場合、メモリを浪費して DoS が成立しうる脆弱性が発見されました。 | ||
| この脆弱性は、[CVE-2018-8777](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8777) として登録されています。 | ||
|
|
||
| ## 詳細 | ||
|
|
||
| 標準添付ライブラリ WEBrick において、攻撃者によって巨大な HTTP ヘッダを持つリクエストが送信された場合、これをメモリ上で処理しようとしているため、メモリを浪費してしまい DoS 攻撃が成立するようになっていました。 | ||
|
|
||
| この問題の影響を受けるバージョンの Ruby のユーザーは、速やかに問題の修正されたバージョンに更新してください。 | ||
|
|
||
| ## 影響を受けるバージョン | ||
|
|
||
| * Ruby 2.2.9 以前の全ての Ruby 2.2 系列 | ||
| * Ruby 2.3.6 以前の全ての Ruby 2.3 系列 | ||
| * Ruby 2.4.3 以前の全ての Ruby 2.4 系列 | ||
| * Ruby 2.5.0 | ||
| * Ruby 2.6.0-preview1 | ||
| * revision 62965 より前の開発版 | ||
|
|
||
| ## クレジット | ||
|
|
||
| この脆弱性情報は、Eric Wong 氏 <e@80x24.org> によって報告されました。 | ||
|
|
||
| ## 更新履歴 | ||
|
|
||
| * 2018-03-28 23:00:00 (JST) 初版 |
34 changes: 34 additions & 0 deletions
34
ja/news/_posts/2018-03-28-poisoned-nul-byte-dir-cve-2018-8780.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,34 @@ | ||
| --- | ||
| layout: news_post | ||
| title: "CVE-2018-8779: Dir において NUL 文字挿入により意図しないディレクトリにアクセスされうる脆弱性について" | ||
| author: "usa" | ||
| date: 2018-03-28 14:00:00 +0000 | ||
| tags: security | ||
| lang: ja | ||
| --- | ||
|
|
||
| Ruby の組み込みクラス `Dir` のいくつかのメソッドにおいて、ディレクトリ名として渡された引数文字列中に NUL 文字を挿入しておくことによって、意図しないディレクトリにアクセスしうるという脆弱性が発見されました。 | ||
| この脆弱性は、[CVE-2018-8779](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8779) として登録されています。 | ||
|
|
||
| ## 詳細 | ||
|
|
||
| 組み込みクラス `Dir` のメソッド `Dir.open`、`Dir.new`、`Dir.entries`、`Dir.empty?` 等では、引数で対象となるディレクトリのパス名を指定します。この際、指定されたパス名中に NUL 文字 (`\0`) が含まれていた場合、NUL 文字直前でパス名が完結しているとみなして、そのパス名に対してアクセスしていました。このため、外部からの入力を `Dir.open` に与えていた場合、その妥当性をスクリプトで確認していたとしても、意図しないパス名のディレクトリにアクセスしうる場合がありました。 | ||
|
|
||
| この問題の影響を受けるバージョンの Ruby のユーザーは、速やかに問題の修正されたバージョンに更新してください。 | ||
|
|
||
| ## 影響を受けるバージョン | ||
|
|
||
| * Ruby 2.2.9 以前の全ての Ruby 2.2 系列 | ||
| * Ruby 2.3.6 以前の全ての Ruby 2.3 系列 | ||
| * Ruby 2.4.3 以前の全ての Ruby 2.4 系列 | ||
| * Ruby 2.5.0 | ||
| * Ruby 2.6.0-preview1 | ||
| * revision 62989 より前の開発版 | ||
|
|
||
| ## クレジット | ||
|
|
||
| この脆弱性情報は、[ooooooo_q](https://hackerone.com/ooooooo_q) 氏によって報告されました。 | ||
|
|
||
| ## 更新履歴 | ||
|
|
||
| * 2018-03-28 23:00:00 (JST) 初版 |
36 changes: 36 additions & 0 deletions
36
ja/news/_posts/2018-03-28-poisoned-nul-byte-unixsocket-cve-2018-8779.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| --- | ||
| layout: news_post | ||
| title: "CVE-2018-8780: UNIX ドメインソケットにおいて NUL 文字挿入により意図しないソケットにアクセスされうる脆弱性について" | ||
| author: "usa" | ||
| date: 2018-03-28 14:00:00 +0000 | ||
| tags: security | ||
| lang: ja | ||
| --- | ||
|
|
||
| Ruby の標準添付ライブラリである socket のメソッド `UNIXServer.open` で、ソケット名として指定された文字列中に NUL 文字を挿入しておくことによって、意図しないパス名でソケットが生成されうるという脆弱性が発見されました。 | ||
| また、同じく `UNIXSocket.open` メソッドにおいても、ソケット名として指定された文字列に NUL 文字を挿入しておくことによって、意図しないパス名のソケットにアクセスしうるという脆弱性も発見されました。 | ||
| この脆弱性は、[CVE-2018-8780](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8780) として登録されています。 | ||
|
|
||
| ## 詳細 | ||
|
|
||
| 標準添付ライブラリ socket のメソッド `UNIXServer.open` では、第 1 引数で生成するソケットのパス名を指定します。この際、指定されたパス名中に NUL 文字 (`\0`) が含まれていた場合、NUL 文字直前でパス名が完結しているとみなして、そのパス名でソケットを生成していました。このため、外部からの入力を `UNIXServer.open` に与えていた場合、その妥当性をスクリプトで確認していたとしても、意図しないパス名でソケットが生成されうる場合がありました。 | ||
| また、同様に、`UNIXSocket.open` においても、第 1 引数でアクセスするソケットのパス名を指定します。この際にも、指定されたパス名中に NUL 文字が含まれていた場合、`UNIXServer.open` と同様にその直前でパス名が完結しているとみなしてそのパス名でソケットにアクセスしていました。このため、外部からの入力を `UNIXSocket.open` に与えていた場合、その妥当性をスクリプトで確認していたとしても、意図しないパス名のソケットにアクセスしうる場合がありました。 | ||
|
|
||
| この問題の影響を受けるバージョンの Ruby のユーザーは、速やかに問題の修正されたバージョンに更新してください。 | ||
|
|
||
| ## 影響を受けるバージョン | ||
|
|
||
| * Ruby 2.2.9 以前の全ての Ruby 2.2 系列 | ||
| * Ruby 2.3.6 以前の全ての Ruby 2.3 系列 | ||
| * Ruby 2.4.3 以前の全ての Ruby 2.4 系列 | ||
| * Ruby 2.5.0 | ||
| * Ruby 2.6.0-preview1 | ||
| * revision 62991 より前の開発版 | ||
|
|
||
| ## クレジット | ||
|
|
||
| この脆弱性情報は、[ooooooo_q](https://hackerone.com/ooooooo_q) 氏によって報告されました。 | ||
|
|
||
| ## 更新履歴 | ||
|
|
||
| * 2018-03-28 23:00:00 (JST) 初版 |
Oops, something went wrong.