#VU15725 Security restrictions bypass


Published: 2018-11-06

Vulnerability identifier: #VU15725

Vulnerability risk: Low

CVSSv3.1:

CVE-ID: CVE-2018-16396

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Ruby
Universal components / Libraries / Scripting languages

Vendor: Ruby

Description
The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The weakness exists due to the tainted flags are not propagated with the BbH, and h directives. A remote attacker can supply inputs by Array#pack and/or String#unpack with these directives and checks the reliability with tainted flags and cause the check to be wrong to bypass security restrictions and conduct further attacks.

Mitigation
The vulnerability has been fixed in the versions 2.3.8, 2.4.5, 2.5.2.

Vulnerable software versions

Ruby: 2.2.3 - 2.6.0-preview2


CPE

External links
http://www.ruby-lang.org/en/news/2018/10/17/not-propagated-taint-flag-in-some-formats-of-pack-cve-2018-16396/


Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?


Latest bulletins with this vulnerability