Ruby’s SSL client implements hostname identity check but it does not properly handle hostnames in the certificate that contain null bytes.
OpenSSL::SSL.verifycertificateidentity implements RFC2818 Server Identity check for Ruby’s SSL client but it does not properly handle hostnames in the subjectAltName X509 extension that contain null bytes.
Existing code in lib/openssl/ssl.rb uses OpenSSL::X509::Extension#value for extracting identity from subjectAltName. Extension#value depends OpenSSL function X509V3EXTprint() and for dNSName of subjectAltName it utilizes sprintf() that is known as null byte unsafe. As the result Extension#value returns ‘www.ruby-lang.org’ if the subjectAltName is ‘www.ruby-lang.org\0.example.com’ and OpenSSL::SSL.verifycertificateidentity wrongly identifies the certificate is for ‘www.ruby-lang.org’.
When a CA a SSL client trusts allows to issue the server certificate that has null byte in subjectAltName, remote attackers can obtain the certificate for ‘www.ruby-lang.org\0.example.com’ from the CA to spoof ‘www.ruby-lang.org’ and do man-in-the-middle between Ruby’s SSL client and SSL servers.
External References:
http://www.ruby-lang.org/en/news/2013/06/27/hostname-check-bypassing-vulnerability-in-openssl-client-cve-2013-4073/
Originally, Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1005 to the following vulnerability:
The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#tos method, as demonstrated by changing an intended pathname.
Later it was reported: [1] http://www.openwall.com/lists/oss-security/2012/10/02/4
that the Ruby nameerrmesgtostr() method is vulnerable to the similar flaw.
Relevant upstream patch: [2] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068
Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.splitheadervalue function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.