From owner-svn-ports-head@FreeBSD.ORG Fri Nov 2 03:17:19 2012 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id 78DE6C64; Fri, 2 Nov 2012 03:17:19 +0000 (UTC) (envelope-from bdrewery@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id 5CEF78FC0C; Fri, 2 Nov 2012 03:17:19 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.4/8.14.4) with ESMTP id qA23HJ5e032435; Fri, 2 Nov 2012 03:17:19 GMT (envelope-from bdrewery@svn.freebsd.org) Received: (from bdrewery@localhost) by svn.freebsd.org (8.14.4/8.14.4/Submit) id qA23HI6Z032433; Fri, 2 Nov 2012 03:17:18 GMT (envelope-from bdrewery@svn.freebsd.org) Message-Id: <201211020317.qA23HI6Z032433@svn.freebsd.org> From: Bryan Drewery Date: Fri, 2 Nov 2012 03:17:18 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r306834 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Nov 2012 03:17:19 -0000 Author: bdrewery Date: Fri Nov 2 03:17:18 2012 New Revision: 306834 URL: http://svn.freebsd.org/changeset/ports/306834 Log: - Document ruby vulnerabilities: * CVE-2012-4464 + CVE-2012-4466 $SAFE escaping vulnerability about Exception#to_s / NameError#to_s * CVE-2012-4522 Unintentional file creation caused by inserting an illegal NUL character Reviewed by: eadler Feature safe: yes Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Fri Nov 2 01:55:13 2012 (r306833) +++ head/security/vuxml/vuln.xml Fri Nov 2 03:17:18 2012 (r306834) @@ -51,6 +51,87 @@ Note: Please add new entries to the beg --> + + ruby - Unintentional file creation caused by inserting an illegal NUL character + + + ruby + 1.9.3,11.9.3.286,1 + + + + +

The official ruby site reports:

+
A vulnerability was found that file creation routines can create + unintended files by strategically inserting NUL(s) in file paths. + This vulnerability has been reported as CVE-2012-4522.
+
Ruby can handle arbitrary binary patterns as Strings, including + NUL chars. On the other hand OSes and other libraries tend not. + They usually treat a NUL as an End of String mark. So to interface + them with Ruby, NUL chars should properly be avoided.
+
However methods like IO#open did not check the filename passed to + them, and just passed those strings to lower layer routines. This + led to create unintentional files.
+

+ + + + CVE-2012-4522 + http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/ + https://access.redhat.com/security/cve/CVE-2012-4522/ + + + 2012-10-12 + 2012-11-01 + + + + + ruby - $SAFE escaping vulnerability about Exception#to_s/NameError#to_s + + + ruby + 1.8.7,11.8.7.371,1 + 1.9.3,11.9.3.286,1 + + + + +

The official ruby site reports:

+
Vulnerabilities found for Exception#to_s, NameError#to_s, and + name_err_mesg_to_s() which is Ruby interpreter-internal API. A + malicious user code can bypass $SAFE check by utilizing one of + those security holes.
+
Ruby's $SAFE mechanism enables untrusted user codes to run in + $SAFE >= 4 mode. This is a kind of sandboxing so some operations + are restricted in that mode to protect other data outside the + sandbox.
+
The problem found was around this mechanism. Exception#to_s, + NameError#to_s, and name_err_mesg_to_s() interpreter-internal API + was not correctly handling the $SAFE bits so a String object which + is not tainted can destructively be marked as tainted using them. + By using this an untrusted code in a sandbox can modify a + formerly-untainted string destructively.
+
Ruby 1.8 once had a similar security issue. It fixed + Exception#to_s and NameError#to_s, but name_err_mesg_to_str() issue + survived previous security fix
+

+ + + + CVE-2012-4464 + CVE-2012-4466 + http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/ + https://access.redhat.com/security/cve/CVE-2012-4464/ + + + 2012-08-21 + 2012-11-01 + + + RT -- Multiple Vulnerabilities