-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                               ASB-2012.0141
                        Ruby 1.9.3-p286 is released
                              15 October 2012

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              Ruby
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact/Access:        Execute Arbitrary Code/Commands -- Existing Account
                      Create Arbitrary Files          -- Existing Account
Resolution:           Patch/Upgrade
CVE Names:            CVE-2012-4466 CVE-2012-4464 
Member content until: Wednesday, November 14 2012

OVERVIEW

        Multiple vulnerabilities have been fixed in Ruby 1.9.3-p286.


IMPACT

        The following information is available from the vendor's website:
        
        CVE-2012-4464, CVE-2012-4466:
        "Vulnerabilities found for Exception#to_s, NameError#to_s, and
        name_err_mesg_to_s() which is Ruby interpreter-internal API. A malicious
        user code can bypass $SAFE check by utilizing one of those security
        holes." [1]
        
        (No CVE):
        "A vulnerability was found that file creation routines can create
        unintended files by strategically inserting NUL(s) in file paths." [2]


MITIGATION

        Users should update to the latest version. [3]


REFERENCES

        [1] $SAFE escaping vulnerability about Exception#to_s / NameError#to_s
            (CVE-2012-4464, CVE-2012-4466)
            http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve-2012-4466/

        [2] Unintentional file creation caused by inserting a illegal NUL
            character
            http://www.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/

        [3] Ruby 1.9.3-p286 is released
            http://www.ruby-lang.org/en/news/2012/10/12/ruby-1-9-3-p286-is-released/

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBUHt5Le4yVqjM2NGpAQIVug/+NQg37fBXe2UsEKa7w976FJt1ZVBM3xJ/
t4yYZQU84uhd5/4zxdENfTzIkRT9TZyGPYBRudKdpYfO4q9v1zHGZqJWiaqUMQOQ
pDPivLH4AMZ98onDs/9ag2/n2yGg56LerMjmw+5Zvwqj7Ao/8buhK+ZgyUjdKkP0
95jydXfK/dgtov1JS/gPOgKs59BNtbFH5hMzV+zcwTntusyxscuT3h6vq6yuOpMn
Ii/Uhq9R3rwLhetkV2XlfALXfC68gwu00AlvVSDJXJwkWjK+rfTL/5HWRgCr+3d9
jzLfO3CkqQW8bEpo8XxcrD9G0yq4lydSMrOct/uc1Y8aa5sKTnk4x6vM6YbJByrL
BAf7zqgfLMzmumMZtaf2UQau6vFv8B3MBPBu0SCZcCj7p2Ll+WDnLKTLsxprpRjU
olqdzreUb0TTP4CB9uKopMbiyYyA6d5dkpst9UzjwFB89cfVSFaVV6VAlRrCJ7QF
tn14GER4GwDf/BFl+83gkutUcWHc3b5Q/OUkkeIi7obWCqYJwyRSsE5UeQETQpdY
6wydKVcpn4zQvnc068l3Hw/LPqjj9r/IsttkNGh/BxtfFxq0G79dFBNDrmKnVN/i
yRbye+0r1sd2FBSkz1vb3ePN2elofEjkKDctxTsaPK7EEu1J8BdmjeT+TIDzq9yZ
FINFUOWsYS4=
=fDTt
-----END PGP SIGNATURE-----