REDHAT-BUG-435902: Low severity webrick vulnerability

Published Mar 4, 2008

Updated

http://www.ruby-lang.org/en/news/2008/03/03/webrick-file-access-vulnerability/

WEBrick, a standard library of Ruby to implement HTTP servers, has file access vulnerability.

1. Systems that accept backslash (\) as a path separator, such as Windows. 2. Systems that use case insensitive filesystems such as NTFS on Windows, HFS on Mac OS X.

Attacker can access private files by sending a url with url encoded backslash (\). This works only on systems that accept backslash as a path separator. Or they could bypass restrictions with case-insensitive filesystems.

Affected Software

1 affected component

Ruby WEBrick

Event History

Mar 4, 2008

Data Sourced

via Red Hat·11:24 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-435902?

The severity of REDHAT-BUG-435902 is considered high due to the potential for unauthorized file access.

How do I fix REDHAT-BUG-435902?

To fix REDHAT-BUG-435902, it is recommended to upgrade to the latest version of Ruby that addresses this vulnerability.

What does REDHAT-BUG-435902 affect?

REDHAT-BUG-435902 affects the WEBrick library in Ruby, which is used for implementing HTTP servers.

Can REDHAT-BUG-435902 lead to data exposure?

Yes, REDHAT-BUG-435902 can lead to data exposure by allowing attackers to access sensitive files on the server.

Is REDHAT-BUG-435902 exploitable remotely?

Yes, REDHAT-BUG-435902 is exploitable remotely, making it critical to apply patches promptly.