FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

ruby -- $SAFE escaping vulnerability about Exception#to_s/NameError#to_s

Affected packages
1.8.7,1 < ruby < 1.8.7.371,1
1.9.3,1 < ruby < 1.9.3.286,1

Details

VuXML ID 2a093853-2495-11e2-b0c7-000d601460a4
Discovery 2012-08-21
Entry 2012-11-01

The official ruby site reports:

Vulnerabilities found for Exception#to_s, NameError#to_s, and name_err_mesg_to_s() which is Ruby interpreter-internal API. A malicious user code can bypass $SAFE check by utilizing one of those security holes.

Ruby's $SAFE mechanism enables untrusted user codes to run in $SAFE >= 4 mode. This is a kind of sandboxing so some operations are restricted in that mode to protect other data outside the sandbox.

The problem found was around this mechanism. Exception#to_s, NameError#to_s, and name_err_mesg_to_s() interpreter-internal API was not correctly handling the $SAFE bits so a String object which is not tainted can destructively be marked as tainted using them. By using this an untrusted code in a sandbox can modify a formerly-untainted string destructively.

Ruby 1.8 once had a similar security issue. It fixed Exception#to_s and NameError#to_s, but name_err_mesg_to_str() issue survived previous security fix

References

CVE Name CVE-2012-4464
CVE Name CVE-2012-4466
URL http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/
URL https://access.redhat.com/security/cve/CVE-2012-4464/