oss-security - CVE Request -- ruby (1.8.x with patched CVE-2011-1005): Incomplete fix for CVE-2011-1005 for NameError#to

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <495551764.7006818.1349450774816.JavaMail.root@redhat.com>
Date: Fri, 5 Oct 2012 11:26:14 -0400 (EDT)
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
Cc: oss-security@...ts.openwall.com, Vit Ondruch <vondruch@...hat.com>,
        Ruby Security Team <security@...y-lang.org>
Subject: CVE Request -- ruby (1.8.x with patched CVE-2011-1005): Incomplete
 fix for CVE-2011-1005 for NameError#to_s method when used on objects

Hello Kurt, Steve, vendors,

  Originally, Common Vulnerabilities and Exposures assigned
an identifier of CVE-2011-1005 to the following vulnerability:

The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7
through 1.8.7-330, and 1.8.8dev allows context-dependent
attackers to modify strings via the Exception#to_s method,
as demonstrated by changing an intended pathname.

with the following upstream patch:
[1] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?revision=30903&view=revision

Based on later upstream patch for different (CVE-2012-4464 and CVE-2012-4466) issues:
[2] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068

it was found that original upstream 1.8.x ruby patch for CVE-2011-1005
issue was not complete, when the NameError#to_s() method was used on /
with Ruby objects (the test logic in 'test_to_s_taintness_propagation'
test from [1] was actually reversed {Hint: Compare the test for Ruby
Object cases in both [1] and [2]}, so the test returned success also
on still vulnerable instances).

A different vulnerability than CVE-2011-1005, CVE-2012-4464, and CVE-2012-4466.

References:
[3] https://bugzilla.redhat.com/show_bug.cgi?id=863484

This issue was discovered by Vit Ondruch of Red Hat.

Ruby Security Team previously in a private email to Vit confirmed
(still) presence of this issue on ruby 1.8.7 versions and provided
a patch for it:
<snip>
The behavior of SVN trunk is correct.

The fix for CVE-2011-1005 was insufficient, and NameError#to_s has a
problem in 1.8.7.

Please apply the attached patch for 1.8.7.

-- Shugo Maeda

error.c.diff

--- error.c.orig	2012-10-04 23:26:42.000611741 +0900
+++ error.c	2012-10-04 23:26:48.960524245 +0900
@@ -665,9 +665,6 @@

     if (NIL_P(mesg)) return rb_class_name(CLASS_OF(exc));
     StringValue(str);
-    if (str != mesg) {
-	OBJ_INFECT(str, mesg);
-    }
     return str;
 }

</snip>

Could you allocate a CVE identifier to this (for those package versions,
which have applied patch for originally CVE-2011-1005 already)?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.