CVE-2007-0469: Critical severity Rubyforge Rubygems vulnerability
The extractfiles function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.
Other sources
The extractfiles function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-0469?
CVE-2007-0469 is considered a moderate severity vulnerability.
How do I fix CVE-2007-0469?
To fix CVE-2007-0469, upgrade RubyGems to version 0.9.1 or later.
What types of attacks can CVE-2007-0469 facilitate?
CVE-2007-0469 can allow attackers to overwrite files, cause denial of service, or execute arbitrary code.
Which versions of RubyGems are affected by CVE-2007-0469?
CVE-2007-0469 affects RubyGems versions up to 0.9.0 inclusive.
What is the primary issue with the extract_files function in CVE-2007-0469?
The extract_files function in CVE-2007-0469 does not check for existing files before overwriting them.