Arbitrary code execution vulnerabilities

ruby-talk
1

You may want to take immediate action on this.
http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/

Some people seem to be seeing problems with the 1.8.6-p230 upgrade,
though.
See comments at:

···

--
Posted via http://www.ruby-forum.com/.

2

# Some people seem to be seeing problems with the 1.8.6-p230 upgrade,
# though.
# See comments at:
# http://weblog.rubyonrails.com/2008/6/21/multiple-ruby-security
# -vulnerabilities

ruby is not rails. upgrading ruby does not mean you've upgraded rails too. wait for the rails upgrade. ask the rails list or dhh.

kind regards -botp

···

From: Mike Berrow [mailto:mberrow1@pacbell.net]

3

Situation summary from RubyInside
http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.html

Updates on Drew Yao’s Terrible Ruby Vulnerabilities [Matasano Security]
http://www.matasano.com/log/1070/updates-on-drew-yaos-terrible-ruby-vulnerabilities/

···

--
Posted via http://www.ruby-forum.com/.

4

You misunderstood. The latest patchlevels of 1.8.5 and 1.8.6 are segfaulting.

jeremy

···

On Fri, Jun 20, 2008 at 11:31 PM, Peña, Botp <botp@delmonte-phil.com> wrote:

From: Mike Berrow [mailto:mberrow1@pacbell.net]
# Some people seem to be seeing problems with the 1.8.6-p230 upgrade,
# though.
# See comments at:
# http://weblog.rubyonrails.com/2008/6/21/multiple-ruby-security
# -vulnerabilities

ruby is not rails. upgrading ruby does not mean you've upgraded rails too. wait for the rails upgrade. ask the rails list or dhh.

5

Jeremy Kemper wrote:

···

On Fri, Jun 20, 2008 at 11:31 PM, Peña, Botp <botp@delmonte-phil.com> wrote:

From: Mike Berrow [mailto:mberrow1@pacbell.net]
# Some people seem to be seeing problems with the 1.8.6-p230 upgrade,
# though.
# See comments at:
# http://weblog.rubyonrails.com/2008/6/21/multiple-ruby-security
# -vulnerabilities

ruby is not rails. upgrading ruby does not mean you've upgraded rails too. wait for the rails upgrade. ask the rails list or dhh.

You misunderstood. The latest patchlevels of 1.8.5 and 1.8.6 are segfaulting.

jeremy

1. Is this on simple reproducible cases or do you need Rails to get a segfault?

2. gdb is your friend. :slight_smile: