CVE-2013-2065: Medium severity suse linux vulnerability

Published Nov 2, 2013

Updated

(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.

Affected Software

20 affected components

openSUSE openSUSE=12.2

openSUSE openSUSE=12.3

ruby-lang Ruby=1.9

ruby-lang Ruby=1.9.1

ruby-lang Ruby=1.9.2

ruby-lang Ruby=1.9.3

ruby-lang Ruby=1.9.3-p0

ruby-lang Ruby=1.9.3-p125

ruby-lang Ruby=1.9.3-p194

ruby-lang Ruby=1.9.3-p286

ruby-lang Ruby=1.9.3-p383

ruby-lang Ruby=1.9.3-p385

ruby-lang Ruby=1.9.3-p392

ruby-lang Ruby=2.0

ruby-lang Ruby=2.0.0

ruby-lang Ruby=2.0.0-p0

ruby-lang Ruby=2.0.0-preview1

ruby-lang Ruby=2.0.0-preview2

ruby-lang Ruby=2.0.0-rc1

ruby-lang Ruby=2.0.0-rc2

Remediation

Patch Available

https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/

Event History

Nov 2, 2013

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2013-2065?

CVE-2013-2065 is classified as a medium severity vulnerability due to its potential to allow unauthorized access through evasion of taint checking.

How do I fix CVE-2013-2065?

To fix CVE-2013-2065, upgrade Ruby to versions 1.9.3 patch level 426 or higher or 2.0.0 patch level 195 or higher.

Which versions of Ruby are affected by CVE-2013-2065?

CVE-2013-2065 affects Ruby versions prior to 1.9.3 patch level 426 and 2.0.0 patch level 195.

What does CVE-2013-2065 affect in Ruby?

CVE-2013-2065 affects the security of native functions in Ruby by allowing bypassing of the intended $SAFE level restrictions.

Can CVE-2013-2065 lead to exploitations?

Yes, CVE-2013-2065 can potentially allow context-dependent attackers to exploit applications using affected Ruby versions.