JVN#13947696

Ruby contains a vulnerability that prevents safe level 4 from functioning as a sandbox.

Overview

Safe level is a security model provided by Ruby language that limits the operation of untrusted objects. A vulnerability that allows an attacker to bypass the safe level restrictions and execute inaccessible methods (ex. destructive methods) was confirmed.

Products Affected

• Ruby 1.8.4-20060516 and earlier Snapshot versions

Description

Impact

An attacker may be able to bypass the security model of a server application and change the status of a untained object.

Solution

Vendor Status

References

JPCERT/CC Addendum

Credit

Akira Tanaka of National Institute of Advanced Industrial Science and Technology (AIST), Japan reported this vulnerability to IPA.
JPCERT/CC coordinated with the vendors under Information Security Early Warning Partnership.

Other Information

Update History