CVE-2011-0188
First published: Fri Mar 04 2011(Updated: )
Drew Yao of Apple Product Security reported a flaw in how Ruby's BigDecimal implementation. In a 64-bit program, if the amount of memory to allocate is greater than 2^32, the allocated amount will be truncated to a 32-bit unsigned integer, however the amount to memset will use the full 64-bit number, leading to a crash or memory corruption. After the memset, the unexpectedly small buffer could be used in other ways that lead to memory corruption or, possibly, code execution. This flaw only affects 64-bit processes. To test whether or not ruby is vulnerable, the following can be used (on a vulnerable ruby it will cause a segfault): $ ruby -e 'require "bigdecimal"; BigDecimal.new("8").**(0x20000000)' Upstream committed the following to fix the flaw: <a href="http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993">http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993</a>
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ruby-lang Ruby | <=1.9.2-p136 | |
| Ruby-lang Ruby | =1.9 | |
| Ruby-lang Ruby | =1.9-r18423 | |
| Ruby-lang Ruby | =1.9.0 | |
| Ruby-lang Ruby | =1.9.0-r18423 | |
| Ruby-lang Ruby | =1.9.0-0 | |
| Ruby-lang Ruby | =1.9.0-1 | |
| Ruby-lang Ruby | =1.9.0-2 | |
| Ruby-lang Ruby | =1.9.0-20060415 | |
| Ruby-lang Ruby | =1.9.0-20070709 | |
| Ruby-lang Ruby | =1.9.1 | |
| Ruby-lang Ruby | =1.9.1--p0 | |
| Ruby-lang Ruby | =1.9.1--p129 | |
| Ruby-lang Ruby | =1.9.1--p243 | |
| Ruby-lang Ruby | =1.9.1--p376 | |
| Ruby-lang Ruby | =1.9.1--p429 | |
| Ruby-lang Ruby | =1.9.1--preview_1 | |
| Ruby-lang Ruby | =1.9.1--preview_2 | |
| Ruby-lang Ruby | =1.9.1--rc1 | |
| Ruby-lang Ruby | =1.9.1--rc2 | |
| Ruby-lang Ruby | =1.9.2 | |
| Ruby-lang Ruby | =1.9.2-dev | |
| Apple Mac OS X | =10.5.8 | |
| Apple Mac OS X | =10.6.0 | |
| Apple Mac OS X | =10.6.1 | |
| Apple Mac OS X | =10.6.2 | |
| Apple Mac OS X | =10.6.3 | |
| Apple Mac OS X | =10.6.4 | |
| Apple Mac OS X | =10.6.5 | |
| Apple Mac OS X | =10.6.6 | |
| Apple Mac OS X Server | =10.5.8 | |
| Apple Mac OS X Server | =10.6.0 | |
| Apple Mac OS X Server | =10.6.1 | |
| Apple Mac OS X Server | =10.6.2 | |
| Apple Mac OS X Server | =10.6.3 | |
| Apple Mac OS X Server | =10.6.4 | |
| Apple Mac OS X Server | =10.6.5 | |
| Apple Mac OS X Server | =10.6.6 |
Remedy
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://support.apple.com/kb/HT4581
- https://bugzilla.redhat.com/show_bug.cgi?id=682332
- http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
- http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993
- http://www.securitytracker.com/id?1025236
- http://www.redhat.com/support/errata/RHSA-2011-0910.html
- http://www.redhat.com/support/errata/RHSA-2011-0908.html
- http://www.redhat.com/support/errata/RHSA-2011-0909.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:097
- http://www.mandriva.com/security/advisories?name=MDVSA-2011:098
- https://rhn.redhat.com/errata/RHSA-2011-0908.html
- https://rhn.redhat.com/errata/RHSA-2011-0910.html
- https://rhn.redhat.com/errata/RHSA-2011-0909.html
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2011-0188
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/references
- agent/description
- agent/tags
- agent/event
- agent/trending
- vendor/ruby-lang
- canonical/ruby-lang ruby
- version/ruby-lang ruby/1.9.2-p136
- version/ruby-lang ruby/1.9
- version/ruby-lang ruby/1.9-r18423
- version/ruby-lang ruby/1.9.0
- version/ruby-lang ruby/1.9.0-r18423
- version/ruby-lang ruby/1.9.0-0
- version/ruby-lang ruby/1.9.0-1
- version/ruby-lang ruby/1.9.0-2
- version/ruby-lang ruby/1.9.0-20060415
- version/ruby-lang ruby/1.9.0-20070709
- version/ruby-lang ruby/1.9.1
- version/ruby-lang ruby/1.9.1--p0
- version/ruby-lang ruby/1.9.1--p129
- version/ruby-lang ruby/1.9.1--p243
- version/ruby-lang ruby/1.9.1--p376
- version/ruby-lang ruby/1.9.1--p429
- version/ruby-lang ruby/1.9.1--preview_1
- version/ruby-lang ruby/1.9.1--preview_2
- version/ruby-lang ruby/1.9.1--rc1
- version/ruby-lang ruby/1.9.1--rc2
- version/ruby-lang ruby/1.9.2
- version/ruby-lang ruby/1.9.2-dev
- vendor/apple
- canonical/apple mac os x
- version/apple mac os x/10.5.8
- version/apple mac os x/10.6.0
- version/apple mac os x/10.6.1
- version/apple mac os x/10.6.2
- version/apple mac os x/10.6.3
- version/apple mac os x/10.6.4
- version/apple mac os x/10.6.5
- version/apple mac os x/10.6.6
- canonical/apple mac os x server
- version/apple mac os x server/10.5.8
- version/apple mac os x server/10.6.0
- version/apple mac os x server/10.6.1
- version/apple mac os x server/10.6.2
- version/apple mac os x server/10.6.3
- version/apple mac os x server/10.6.4
- version/apple mac os x server/10.6.5
- version/apple mac os x server/10.6.6