NVD Vulnerability Detail

CVE-2013-2065

Summary	(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.
Publication Date	Nov. 3, 2013, 4:55 a.m.
Registration Date	Jan. 26, 2021, 3:37 p.m.
Last Update	Nov. 21, 2024, 10:50 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107064.html
2	http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107064.html
3	http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107098.html
4	http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107098.html
5	http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107120.html
6	http://lists.fedoraproject.org/pipermail/package-announce/2013-May/107120.html
7	http://lists.opensuse.org/opensuse-updates/2013-10/msg00057.html	Vendor Advisory
8	http://lists.opensuse.org/opensuse-updates/2013-10/msg00057.html	Vendor Advisory
9	http://www.ubuntu.com/usn/USN-2035-1
10	http://www.ubuntu.com/usn/USN-2035-1
11	https://puppet.com/security/cve/cve-2013-2065
12	https://puppet.com/security/cve/cve-2013-2065
13	https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/	Exploit Patch Vendor Advisory
14	https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/	Exploit Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-264	認可・権限・アクセス制御	https://cwe.mitre.org/data/definitions/264.html

JVN Vulnerability Information

Ruby の DL および Fiddle における $SAFE レベルの制限を回避される脆弱性

Title	Ruby の DL および Fiddle における $SAFE レベルの制限を回避される脆弱性
Summary	Ruby の (1) DL および (2) Fiddle は、ネイティブ関数に対して taint check を実行しないため、$SAFE レベルの制限を回避される脆弱性が存在します。
Possible impacts	攻撃者により、$SAFE レベルの制限を回避される脆弱性が存在します。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	May 14, 2013, midnight
Registration Date	Nov. 5, 2013, 7:13 p.m.
Last Update	Nov. 5, 2013, 7:13 p.m.

Affected System

Ruby-lang.org

Ruby 1.9.3 patchlevel 426 未満の 1.9

Ruby 2.0.0 patchlevel 195 未満の 2.0

Novell

openSUSE 12.2

openSUSE 12.3

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-2065	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2065
National Vulnerability Database (NVD)
2	CVE-2013-2065	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2065

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-264	https://jvndb.jvn.jp/ja/cwe/CWE-264.html

ベンダー情報

No	Name	URL
opensuse-updates
1	openSUSE-SU-2013:1611	http://lists.opensuse.org/opensuse-updates/2013-10/msg00057.html
ruby-lang
2	Object taint bypassing in DL and Fiddle in Ruby (CVE-2013-2065)	https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/

Change Log

No	Changed Details	Date of change
0	[2013年11月05日] 掲載	Feb. 17, 2018, 10:37 a.m.