[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-id: <a90fa22f-d8ac-4712-95dc-4aa89a142ec9@me.com>
Date: Fri, 02 Aug 2013 07:12:37 +0000 (GMT)
From: "Larry W. Cashdollar" <larry0@...com>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Rgpg Ruby Gem Remote Command Injection (CVE Request)
Title: Rgpg Ruby Gem Remote Command Injection
Date: 7/31/2013
Advisory Author: Larry W. Cashdollar, @_larry0
CVE: TBD
Download: https://rubygems.org/gems/rgpg
Description:
"A simple Ruby wrapper around gpg command for file encryption.
rgpg is a simple API for interacting with the gpg tool. It is specifically designed to avoid altering global keyring state by creating temporary public and secret keyrings on the fly for encryption and decryption."
Vulnerability:
The following code snippet does not sanitize user supplied input before passing it to the System () function for execution. If this API is used in the context of a rails application remote commands can be injected into the shell if the user supplies shell meta characters like ; and &.
in lib/rgpg/gpg_helper.rb:
68 begin
69 outputfile.close
70 result = system("#{commandline} > #{output_file.path} 2>&1")
71 ensure
Author: Notified 8/1/2013.
Fixed: in 0.2.3. 8/1/2013.
Greets to all@...CON21.
Content of type "text/html" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
