CVE-2006-4111: Code Injection
Published Aug 14, 2006
·Updated
Ruby on Rails before 1.1.5 allows remote attackers to execute Ruby code with "severe" or "serious" impact via a File Upload request with an HTTP header that modifies the LOADPATH variable, a different vulnerability than CVE-2006-4112.
Affected Software
34 affected componentsFixes available
rubyonrails ruby on Rails=0.8.0
rubyonrails ruby on Rails=0.5.7
rubyonrails ruby on Rails=0.7.0
rubyonrails ruby on Rails<=1.1.4
rubyonrails ruby on Rails=0.8.5
rubyonrails ruby on Rails=0.6.0
rubyonrails ruby on Rails=0.5.6
rubyonrails ruby on Rails=0.9.0
rubyonrails ruby on Rails=0.5.5
rubyonrails ruby on Rails=0.5.0
rubyonrails ruby on Rails=0.6.5
rubyonrails Rails=0.9.1
rubyonrails Rails=0.9.2
rubyonrails Rails=0.9.3
rubyonrails Rails=0.9.4
rubyonrails Rails=0.9.4.1
rubyonrails Rails=0.10.0
rubyonrails Rails=0.10.1
rubyonrails Rails=0.11.0
rubyonrails Rails=0.11.1
rubyonrails Rails=0.12.0
rubyonrails Rails=0.12.1
rubyonrails Rails=0.13.0
rubyonrails Rails=0.13.1
rubyonrails Rails=0.14.1
rubyonrails Rails=0.14.2
rubyonrails Rails=0.14.3
rubyonrails Rails=0.14.4
rubyonrails Rails=1.0.0
rubyonrails Rails=1.1.1
rubyonrails Rails=1.1.2
rubyonrails Rails=1.1.3
rubyonrails Rails=1.1.0
rubygems/rails>=1.1.0<1.1.6
1.1.6
Remediation
Patch Available
Patch Available
Event History
Aug 14, 2006
CVE Published
09:04 PM
Aug 15, 2006
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Oct 24, 2017
Advisory Published
via GitHub·06:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2006-4111?
CVE-2006-4111 has been classified as a severe vulnerability allowing remote code execution.
2
How do I fix CVE-2006-4111?
To fix CVE-2006-4111, you should upgrade to Ruby on Rails version 1.1.5 or later.
3
Which versions of Ruby on Rails are affected by CVE-2006-4111?
CVE-2006-4111 affects Ruby on Rails versions prior to 1.1.5, including 0.5.0 through 1.1.4.
4
What kind of attack vector is utilized in CVE-2006-4111?
CVE-2006-4111 can be exploited via a malicious file upload that modifies the LOAD_PATH variable.
5
Is CVE-2006-4111 related to any other vulnerabilities?
Yes, CVE-2006-4111 is a different vulnerability than CVE-2006-4112, although both affect Ruby on Rails.