Quantum Secular Labs / Blog / Advisories

CVE-2008-2662: Ruby Lang: Buffer overflow

CVE-2008-2662 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Ruby Lang, along with 2 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption, a different issue than CVE-2008-2663, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. This CVE description should be regarded as authoritative, although it is likely to change.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Affected products

  • Ruby Lang: up to and including 1.8.4; after 1.8.5 before 1.8.5.231; from 1.8.6 before 1.8.6.230; from 1.8.7 before 1.8.7.22; from 1.9.0 before 1.9.0.2
  • Debian Linux: 4.0
  • Canonical Ubuntu Linux: 6.06; 7.04; 7.10; 8.04

References