CVE-2012-4481: Medium severity ruby-lang Ruby vulnerability
Originally, Common Vulnerabilities and Exposures assigned an identifier of CVE-2011-1005 to the following vulnerability:
The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#tos method, as demonstrated by changing an intended pathname.
with the following upstream patch: [1] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?revision=30903&view=revision
Based on later upstream patch for different (CVE-2012-4464 and CVE-2012-4466) issues: [2] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068
it was found that original upstream 1.8.x ruby patch for CVE-2011-1005 issue was not complete, when the NameError#tos() method was used on / with Ruby objects (the test logic in 'testtostaintnesspropagation' test from [1] was actually reversed, so the test returned success also on still vulnerable instances).
Acknowledgements:
This issue was discovered by Vit Ondruch of Red Hat.
Other sources
The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#tos method when operating on Ruby objects. NOTE: this issue is due to an incomplete fix for CVE-2011-1005.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4481?
CVE-2012-4481 is considered a moderate severity vulnerability.
How do I fix CVE-2012-4481?
To fix CVE-2012-4481, upgrade Ruby to version 1.8.7-331 or later.
What software versions are affected by CVE-2012-4481?
CVE-2012-4481 affects Ruby versions 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev.
What type of vulnerability is CVE-2012-4481?
CVE-2012-4481 is a vulnerability related to the safe-level feature in Ruby.
Is CVE-2012-4481 still a concern for my applications?
If you are using an affected version of Ruby, CVE-2012-4481 remains a concern for security in your applications.