CVE-2011-0188
First published: Fri Mar 04 2011(Updated: )
Drew Yao of Apple Product Security reported a flaw in how Ruby's BigDecimal implementation. In a 64-bit program, if the amount of memory to allocate is greater than 2^32, the allocated amount will be truncated to a 32-bit unsigned integer, however the amount to memset will use the full 64-bit number, leading to a crash or memory corruption. After the memset, the unexpectedly small buffer could be used in other ways that lead to memory corruption or, possibly, code execution. This flaw only affects 64-bit processes. To test whether or not ruby is vulnerable, the following can be used (on a vulnerable ruby it will cause a segfault): $ ruby -e 'require "bigdecimal"; BigDecimal.new("8").**(0x20000000)' Upstream committed the following to fix the flaw: <a href="http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993">http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993</a>
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ruby | <=1.9.2-p136 | |
| Ruby | =1.9 | |
| Ruby | =1.9-r18423 | |
| Ruby | =1.9.0 | |
| Ruby | =1.9.0-r18423 | |
| Ruby | =1.9.0-0 | |
| Ruby | =1.9.0-1 | |
| Ruby | =1.9.0-2 | |
| Ruby | =1.9.0-20060415 | |
| Ruby | =1.9.0-20070709 | |
| Ruby | =1.9.1 | |
| Ruby | =1.9.1--p0 | |
| Ruby | =1.9.1--p129 | |
| Ruby | =1.9.1--p243 | |
| Ruby | =1.9.1--p376 | |
| Ruby | =1.9.1--p429 | |
| Ruby | =1.9.1--preview_1 | |
| Ruby | =1.9.1--preview_2 | |
| Ruby | =1.9.1--rc1 | |
| Ruby | =1.9.1--rc2 | |
| Ruby | =1.9.2 | |
| Ruby | =1.9.2-dev | |
| Apple iOS and macOS | =10.5.8 | |
| Apple iOS and macOS | =10.6.0 | |
| Apple iOS and macOS | =10.6.1 | |
| Apple iOS and macOS | =10.6.2 | |
| Apple iOS and macOS | =10.6.3 | |
| Apple iOS and macOS | =10.6.4 | |
| Apple iOS and macOS | =10.6.5 | |
| Apple iOS and macOS | =10.6.6 | |
| Apple macOS Server | =10.5.8 | |
| Apple macOS Server | =10.6.0 | |
| Apple macOS Server | =10.6.1 | |
| Apple macOS Server | =10.6.2 | |
| Apple macOS Server | =10.6.3 | |
| Apple macOS Server | =10.6.4 | |
| Apple macOS Server | =10.6.5 | |
| Apple macOS Server | =10.6.6 |
Remedy
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://support.apple.com/kb/HT4581
- https://bugzilla.redhat.com/show_bug.cgi?id=682332
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993
- http://www.securitytracker.com/id?1025236
- http://www.redhat.com/support/errata/RHSA-2011-0910.html
- http://www.redhat.com/support/errata/RHSA-2011-0908.html
- http://www.redhat.com/support/errata/RHSA-2011-0909.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:097
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:098
- https://rhn.redhat.com/errata/RHSA-2011-0908.html
- https://rhn.redhat.com/errata/RHSA-2011-0910.html
- https://rhn.redhat.com/errata/RHSA-2011-0909.html
Frequently Asked Questions
What is the severity of CVE-2011-0188?
CVE-2011-0188 is considered to have a moderate severity due to the potential memory allocation issues in Ruby's BigDecimal implementation.
How do I fix CVE-2011-0188?
To fix CVE-2011-0188, upgrade Ruby to a version later than 1.9.2-p136 that addresses this vulnerability.
Which versions of Ruby are affected by CVE-2011-0188?
CVE-2011-0188 affects Ruby versions up to and including 1.9.2-p136.
Does CVE-2011-0188 affect macOS?
No, CVE-2011-0188 does not affect macOS versions stated in the vulnerability report.
What kind of issue does CVE-2011-0188 represent?
CVE-2011-0188 represents a memory truncation issue that could potentially lead to unexpected behavior in applications using Ruby.
- collector/nvd-historical
- agent/type
- agent/first-publish-date
- agent/remedy
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-0188
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/ruby-lang
- canonical/ruby
- version/ruby/1.9.2-p136
- version/ruby/1.9
- version/ruby/1.9-r18423
- version/ruby/1.9.0
- version/ruby/1.9.0-r18423
- version/ruby/1.9.0-0
- version/ruby/1.9.0-1
- version/ruby/1.9.0-2
- version/ruby/1.9.0-20060415
- version/ruby/1.9.0-20070709
- version/ruby/1.9.1
- version/ruby/1.9.1--p0
- version/ruby/1.9.1--p129
- version/ruby/1.9.1--p243
- version/ruby/1.9.1--p376
- version/ruby/1.9.1--p429
- version/ruby/1.9.1--preview_1
- version/ruby/1.9.1--preview_2
- version/ruby/1.9.1--rc1
- version/ruby/1.9.1--rc2
- version/ruby/1.9.2
- version/ruby/1.9.2-dev
- vendor/apple
- canonical/apple ios and macos
- version/apple ios and macos/10.5.8
- version/apple ios and macos/10.6.0
- version/apple ios and macos/10.6.1
- version/apple ios and macos/10.6.2
- version/apple ios and macos/10.6.3
- version/apple ios and macos/10.6.4
- version/apple ios and macos/10.6.5
- version/apple ios and macos/10.6.6
- canonical/apple macos server
- version/apple macos server/10.5.8
- version/apple macos server/10.6.0
- version/apple macos server/10.6.1
- version/apple macos server/10.6.2
- version/apple macos server/10.6.3
- version/apple macos server/10.6.4
- version/apple macos server/10.6.5
- version/apple macos server/10.6.6