Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 300468 (CVE-2009-4492)

Summary: <dev-lang/ruby-{1.8.6_p388, 1.8.7_p249, 1.9.1_p378} webrick missing terminal escaping (CVE-2009-4492)
Product: Gentoo Security Reporter: Alex Legler (RETIRED) <a3li>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: normal CC: ruby
Priority: High    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection/
Whiteboard: 1.8.x: A3? [glsa] 1.9.x.: ~3? [noglsa]
Package list:
Runtime testing required: ---

Description Alex Legler (RETIRED) archtester gentoo-dev Security 2010-01-10 16:49:57 UTC 
From $URL:
A vulnerability was found on WEBrick, a part of Ruby's standard library. WEBrick lets attackers to inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim's terminal emulator.
[...]
Terminal escape sequences are used to allow various forms of interaction between a terminal and a inside process. The problem is that those sequences are not intended to be issued by untrusted sources; such as network inputs. So if a remote attacker could inject escape sequences into WEBrick logs, and a victim happen to consult them through his/her terminal, the attacker could take advantages of various weaknesses in terminal emulators.
Comment 1 Alex Legler (RETIRED) archtester gentoo-dev Security 2010-01-10 22:08:41 UTC 
Arches, please test and mark stable:
=app-admin/eselect-ruby-20091225
=dev-lang/ruby-1.8.6_p388
=dev-lang/ruby-1.8.7_p249
Target keywords : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"
Comment 2 Christian Faulhammer (RETIRED) gentoo-dev 2010-01-11 13:12:44 UTC 
x86 stable
Comment 3 Christian Faulhammer (RETIRED) gentoo-dev 2010-01-11 13:15:03 UTC 
x86 stable
Comment 4 Brent Baude (RETIRED) gentoo-dev 2010-01-11 16:10:42 UTC 
ppc and ppc64 done
Comment 5 Jeroen Roovers (RETIRED) gentoo-dev 2010-01-12 17:57:13 UTC 
Stable for HPPA.
Comment 6 Raúl Porcel (RETIRED) gentoo-dev 2010-01-13 19:26:39 UTC 
alpha/arm/ia64/s390/sh/sparc stable
Comment 7 Alex Legler (RETIRED) archtester gentoo-dev Security 2010-01-13 19:37:31 UTC 
amd64 stable
Comment 8 Tobias Heinlein (RETIRED) gentoo-dev 2010-01-13 19:50:20 UTC 
YES.
Comment 9 Alex Legler (RETIRED) archtester gentoo-dev Security 2010-01-13 20:41:29 UTC 
Removed vulnerable ebuilds, GLSA draft filed.
Comment 10 Alex Legler (RETIRED) archtester gentoo-dev Security 2010-01-14 07:49:26 UTC 
CVE-2009-4492 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4492):
  WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through
  patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev
  writes data to a log file without sanitizing non-printable
  characters, which might allow remote attackers to modify a window's
  title, or possibly execute arbitrary commands or overwrite files, via
  an HTTP request containing an escape sequence for a terminal emulator.
Comment 11 Alex Legler (RETIRED) archtester gentoo-dev Security 2010-01-14 15:08:17 UTC 
GLSA 201001-09 for Ruby 1.8.x.

Ruby 1.9.1 is hardmasked and suffering from a regression that needs to be addressed. Keeping the bug open until it is fixed.
Comment 12 Alex Legler (RETIRED) archtester gentoo-dev Security 2010-05-01 10:36:34 UTC 
1.9.1-p376 is in the tree.
1.9.x is masked and was never stable. Closing.