Command injection in ruby (Alpine package)

1) Command injection

EUVDB-ID: #VU9718

Risk: High

CVSSv4.0: 8.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2017-17405

CWE-ID: CWE-77 - Command injection

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists due to flaws in the Net::FTP. A remote attacker can inject and execute arbitrary commands with elevated privileges.

Successful exploitation of the vulnerability may result in system compromise.

Mitigation

Install update from vendor's website.

Vulnerable software versions

ruby (Alpine package): 2.2.2-r0 - 2.2.8-r0

CPE2.3

• cpe:2.3:a:alpine:ruby_alpine_package:2.2.2-r0:*:*:*:*:alpine_linux:*:3.1
• cpe:2.3:a:alpine:ruby_alpine_package:2.2.3-r0:*:*:*:*:alpine_linux:*:3.2
• cpe:2.3:a:alpine:ruby_alpine_package:2.2.3-r1:*:*:*:*:alpine_linux:*:3.2

External links

https://git.alpinelinux.org/aports/commit/?id=4badd65f51c8099060803ef81deb2857141a06cd
https://git.alpinelinux.org/aports/commit/?id=417c78cacde26037a301ba228963532d89f5f5cd
https://git.alpinelinux.org/aports/commit/?id=58244868e7a471ddf96e8d0ece88c240e34bff1c
https://git.alpinelinux.org/aports/commit/?id=228ad274b6dd232df47e251fe4ebdbe787d5a933
https://git.alpinelinux.org/aports/commit/?id=0666c3405e078562e5e6cefc77d45e8cc91092bc
https://git.alpinelinux.org/aports/commit/?id=4d3e21cd9e4a1ac17bd8582d2daf97d3e909b6c9
https://git.alpinelinux.org/aports/commit/?id=898d53395529739f04cec4af0f209067bbca56c6
https://git.alpinelinux.org/aports/commit/?id=41e842fa63e1403ba0fa01384e80bd97f5a48dd0
https://git.alpinelinux.org/aports/commit/?id=ade270638ee342c0a9a3c46320ffb8382485b762

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.