Poison null byte in Ruby - CVE-2018-8779

Vulnerability identifier: #VU11541

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-8779

CWE-ID: CWE-626

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to write arbitrary files on the target system.

The weakness exists in the UNIXServer.open and UNIXSocket.open methods due to improper checking of null characters. A remote attacker can accept the socket file in the unintentional path.

Ruby
Debian Linux
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
macOS
Slackware Linux
Opensuse
Fedora
EMC Integrated Data Protection Appliance
ruby (Alpine package)
ruby
Dell EMC Data Protection Search

Update to versions 2.2.10, 2.3.7, 2.4.4 or 2.5.1.

EMC Integrated Data Protection Appliance - update to 2.7.1
ruby (Alpine package) - update to 2.3.7-r0
Dell EMC Data Protection Search - update to 19.6.0
ruby - addressed in versions 2.4.4-88.fc26, 2.4.4-88.fc27, 2.4.4-89.fc27, 2.5.1-92.fc28

• https://www.ruby-lang.org/en/news/2018/03/28/poisoned-nul-byte-unixsocket-cve-2018-8779/

• Slackware Linux update for ruby
• Debian update for ruby2.3
• Multiple vulnerabilities in Apple MacOS
• Red Hat update for ruby
• Red Hat update for ruby
• Red Hat update for ruby
• Red Hat update for ruby
• OpenSUSE Linux update for ruby-bundled-gems-rpmhelper, ruby2.5
• Poison null byte in ruby (Alpine package)
• Multiple vulnerabilities in Dell EMC Integrated Data Protection Appliance
• Multiple vulnerabilities in Dell EMC Data Protection Search
• Fedora 28 update for ruby
• Fedora 26 update for ruby
• Fedora 27 update for ruby
• Fedora 27 update for ruby