Ruby News

RubyConf 2008 is Sold-out

Thu, 02 Oct 2008 23:21:06 GMT

RubyConf 2008 is sold out

However, there is a waiting list you can join in case of cancellations.

Voices That Matter 2008

Tue, 09 Sep 2008 02:49:37 GMT

Pearson Education is running a Voices That Matter Ruby conference this fall in Boston. The conference, from the same people who Addison-Wesley's Professional Ruby Series, will give you a chance to meet and learn from those very same authors. Don't miss a chance to interact with so many Ruby professionals.

DoS vulnerability in REXML

Sat, 23 Aug 2008 07:56:11 GMT

There is a DoS vulnerability in the REXML library included in the Ruby Standard Library. A so-called "XML entity explosion" attack technique can be used for remotely bringing down (disabling) any application which parses user-provided XML using REXML.

Most Rails applications will be vulnerable because Rails parses user-provided XML using REXML by default.

Impact

An attacker can cause a denial of service by causing REXML to parse a document containing recursively nested entities such as:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE member [
  <!ENTITY a "&b;&b;&b;&b;&b;&b;&b;&b;&b;&b;">
  <!ENTITY b "&c;&c;&c;&c;&c;&c;&c;&c;&c;&c;">
  <!ENTITY c "&d;&d;&d;&d;&d;&d;&d;&d;&d;&d;">
  <!ENTITY d "&e;&e;&e;&e;&e;&e;&e;&e;&e;&e;">
  <!ENTITY e "&f;&f;&f;&f;&f;&f;&f;&f;&f;&f;">
  <!ENTITY f "&g;&g;&g;&g;&g;&g;&g;&g;&g;&g;">
  <!ENTITY g "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx">
]>
<member>
&a;
</member>

Vulnerable versions

1.8 series

1.8.6-p287 and all prior versions
1.8.7-p72 and all prior versions

1.9 series

all versions

Solution

Please download the following monkey patch to fix this problem.

<URL:http://www.ruby-lang.org/security/20080823rexml/rexml-expansion-fix.rb>

Then fix your application to load rexml-expansion-fix.rb before using REXML.

require "rexml-expansion-fix"
...
doc = REXML::Document.new(str)
...

If you have a Rails application, copy rexml-expansion-fix.rb into a directory on the load path (such as RAILS_ROOT/lib/), and put the following line into config/environment.rb.

require "rexml-expansion-fix"

If your application is Rails 2.1 or later, you can simply copy rexml-expansion-fix.rb to RAILS_ROOT/config/initializers and it will be required automatically.

By default, XML entity expansion limit is 10000. You can change it by changing REXML::Document.entity_expansion_limit. e.g.

REXML::Document.entity_expansion_limit = 1000

This fix will be made available as a gem and used by future versions of rails, but users should take corrective action immediately.

Credit

Credit to Luka Treiber and Mitja Kolsek of ACROS Security for disclosing the problem to Ruby and Rails Security Teams.

Credit to Michael Koziarski of Rails Core Team for creating the monkey patch to fix the vulnerability.

Changes

2008-08-29 18:46 +09:00 fixed the summary not to mislead that this vulnerability is Rails specific.

Ruby 1.8.7-p72 and 1.8.6-p287 released

Mon, 11 Aug 2008 02:01:00 GMT

Ruby 1.8.7-p72 and 1.8.6-p287 have been released. The last releases were incomplete, and the new releases include fixes of the previously announced vulnerability of dl.

The released source archives are available at:

Checksums:

MD5(ruby-1.8.6-p287.tar.gz)= f6cd51001534ced5375339707a757556
SHA256(ruby-1.8.6-p287.tar.gz)= 6463d1932c34ff72b79174ac7d2c28940d29d147928250928a00a0dbee43db57
SIZE(ruby-1.8.6-p287.tar.gz)= 4590393

MD5(ruby-1.8.6-p287.tar.bz2)= 80b5f3db12531d36e6c81fac6d05dda9
SHA256(ruby-1.8.6-p287.tar.bz2)= ac15a1cb78c50ec9cc7e831616a143586bdd566bc865c6b769a0c47b3b3936ce
SIZE(ruby-1.8.6-p287.tar.bz2)= 3956902

MD5(ruby-1.8.6-p287.zip)= e555d51f5b387fdd52ae53d9bafa13f5
SHA256(ruby-1.8.6-p287.zip)= 844c66c015565839531a34b83e0526cd4fa2a71cc0f5cc8ddb0d4c158403543a
SIZE(ruby-1.8.6-p287.zip)= 5606238

MD5(ruby-1.8.7-p72.tar.gz)= 5e5b7189674b3a7f69401284f6a7a36d
SHA256(ruby-1.8.7-p72.tar.gz)= e15ca005076f5d6f91fc856fdfbd071698a4cadac3c6e25855899dba1f6fc5ef
SIZE(ruby-1.8.7-p72.tar.gz)= 4805594

MD5(ruby-1.8.7-p72.tar.bz2)= 0b215c46b89b28d7ab8d56d96e72d5b9
SHA256(ruby-1.8.7-p72.tar.bz2)= a8f8a28e286dd76747d8e97ea5cfe7a315eb896906ab8c8606d687d9f6f6146e
SIZE(ruby-1.8.7-p72.tar.bz2)= 4127450

MD5(ruby-1.8.7-p72.zip)= b44fe5a12d4bf138ba0d3660e13a8216
SHA256(ruby-1.8.7-p72.zip)= 77e67be4aa8c3e041e1d20d24e5fcf2e33ad9bccb3da3332b6c0a5b648334903
SIZE(ruby-1.8.7-p72.zip)= 5855902

For a full list of all changes, see the bundled files named ChangeLog, which are also available at the following locations:

Multiple vulnerabilities in Ruby

Fri, 08 Aug 2008 02:59:49 GMT

Multiple vulnerabilities have been discovered in Ruby. It's recommended that you upgrade to the latest versions.

Details

The following vulnerabilities have been discovered.

Several vulnerabilities in safe level

Several vulnerabilities in safe level have been discovered.

untrace_var is permitted at safe level 4.

trace_var(:$VAR) {|val| puts "$VAR = #{val}" }

Thread.new do
 $SAFE = 4
 eval %q{
   proc = untrace_var :$VAR
   proc.first.call("aaa")
 }
end.join

$PROGRAM_NAME may be modified at safe level 4.

Thread.new do
 $SAFE = 4
 eval %q{$PROGRAM_NAME.replace "Hello, World!"}
end.join

$PROGRAM_NAME #=> "Hello, World!"

Insecure methods may be called at safe level 1-3.

class Hello
 def world
   Thread.new do
     $SAFE = 4
     msg = "Hello, World!"
     def msg.size
       self.replace self*10 # replace string
       1 # return wrong size
     end
     msg
   end.value
 end
end

$SAFE = 1 # or 2, or 3
s = Hello.new.world
if s.kind_of?(String)
 puts s if s.size < 20 # print string which size is less than 20
end

Syslog operations are permitted at safe level 4.

require "syslog"

Syslog.open

Thread.new do
 $SAFE = 4
 eval %q{
   Syslog.log(Syslog::LOG_WARNING, "Hello, World!")
   Syslog.mask = Syslog::LOG_UPTO(Syslog::LOG_EMERG)
   Syslog.info("masked")
   Syslog.close
 }
end.join

These vulnerabilities were reported by Keita Yamaguchi.

DoS vulnerability in WEBrick

WEBrick::HTTP::DefaultFileHandler is faulty of exponential time taking requests due to a backtracking regular expression in WEBrick::HTTPUtils.split_header_value.

Exploitable server:

require 'webrick'
WEBrick::HTTPServer.new(:Port => 2000, :DocumentRoot => "/etc").start

Attack:

require 'net/http'
res = Net::HTTP.start("localhost", 2000) { |http|
  req = Net::HTTP::Get.new("/passwd")
  req['If-None-Match'] = %q{meh=""} + %q{foo="bar" } * 100
  http.request(req)
}
p res

The request likely won't finish in this universe.

This vulnerability was reported by Christian Neukirchen.

Lack of taintness check in dl

dl doesn't check taintness, so it could allow attackers to call dangerous functions.

require 'dl'
$SAFE = 1
h = DL.dlopen(nil)
sys = h.sym('system', 'IP')
uname = 'uname -rs'.taint
sys[uname]

This vulnerability was reported by sheepman.

DNS spoofing vulnerability in resolv.rb

resolv.rb allow remote attackers to spoof DNS answers. This risk can be reduced by randomness of DNS transaction IDs and source ports, so resolv.rb is fixed to randomize them.

see also: CVE-2008-1447

This vulnerability was reported by Tanaka Akira.

Vulnerable versions

1.8 series

1.8.5 and all prior versions
1.8.6-p286 and all prior versions
1.8.7-p71 and all prior versions

1.9 series

r18423 and all prior revisions

Solution

1.8 series

Please upgrade to 1.8.6-p287, or 1.8.7-p72.

1.9 series

Please check out the latest version using Subversion.

$ svn co http://svn.ruby-lang.org/repos/ruby/trunk ruby

Please note that a package that corrects this weakness may already be available through your package management software.

Credit

Credit to Keita Yamaguchi, Christian Neukirchen, sheepman, and Tanaka Akira for disclosing these problems to Ruby Security Team.

Changes

2008-08-08 12:21 +09:00 fixed the revision number of ruby 1.9.
2008-08-11 11:23 +09:00 fixed the patchlevel of ruby 1.8. see the release announcement of Ruby 1.8.7-p72 and 1.8.6-p287

RubyConf 2008 Proposals Now Being Accepted

Mon, 04 Aug 2008 20:26:29 GMT

RubyConf 2008 will be held in Orlando, Florida, USA, from November 6 to November 8.

Proposals for presentations are now begin accepted. All proposals must be received by August 21.

Arbitrary code execution vulnerabilities

Fri, 20 Jun 2008 12:54:43 GMT

Multiple vulnerabilities in Ruby may lead to a denial of service (DoS) condition or allow execution of arbitrary code.

Impact

With the following vulnerabilities, an attacker can lead to denial of service condition or execute arbitrary code.

Vulnerable versions

1.8 series

1.8.4 and all prior versions
1.8.5-p230 and all prior versions
1.8.6-p229 and all prior versions
1.8.7-p21 and all prior versions

1.9 series

1.9.0-1 and all prior versions

Solution

1.8 series

Please upgrade to 1.8.5-p231, or 1.8.6-p230, or 1.8.7-p22.

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p231.tar.gz> (md5sum: e900cf225d55414bffe878f00a85807c)
<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p230.tar.gz> (md5sum: 5e8247e39be2dc3c1a755579c340857f)
<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p22.tar.gz> (md5sum: fc3ede83a98f48d8cb6de2145f680ef2)

1.9 series

Please upgrade to 1.9.0-2.

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.0-2.tar.gz> (md5sum: 2a848b81ed1d6393b88eec8aa6173b75)

These versions also fix the vulnerability of WEBrick (CVE-2008-1891).

Please note that a package that corrects this weakness may already be available through your package management software.

Credit

Credit to Drew Yao of Apple Product Security for disclosing the problem to Ruby Security Team.

Changes

2008-06-21 00:29 +09:00 removed wrong CVE IDs (CVE-2008-2727, CVE-2008-2728).

RubyNation 2008

Mon, 16 Jun 2008 22:05:00 GMT

RubyNation is an annual Ruby conference serving the Virginia, West Virginia, Maryland, and Washington, DC areas. This year's RubyNation will happen on August 1&2, 2008 in Herndon, VA. Please visit the RubyNation site for more details.

Ruby 1.8.7 has been released

Sat, 31 May 2008 16:55:58 GMT

Akinori MUSHA announced today that Ruby 1.8.7 has been released.

The new version of Ruby includes many bug fixes, lots of feature enhancements backported from 1.9 and some performance improvements since 1.8.6 while maintaining stability and backward compatibility with the previous release to a high degree. See the bundled documentation for details about compatibility issues.

The source code package is available in three formats at the following locations:

Checksums:

MD5 (ruby-1.8.7.tar.bz2) = f17f14c8d55e731b3ce1bc35c42f0a6c
SHA256 (ruby-1.8.7.tar.bz2) = 65f2a862ba5e88bac7a78cff15bcb88d7534e741b51a1ffb79a0136c7041359a
SIZE (ruby-1.8.7.tar.bz2) = 4100024

MD5 (ruby-1.8.7.tar.gz) = de906850f9a012c12ffc6e9f56fb1b66
SHA256 (ruby-1.8.7.tar.gz) = 600dccf13bca3e4179fa6ff554220ce4ba67ffc72bce1ac3bf74c2599c03a0ca
SIZE (ruby-1.8.7.tar.gz) = 4799732

MD5 (ruby-1.8.7.zip) = 14d3eb37b32e4a26966bdd80f361ccd2
SHA256 (ruby-1.8.7.zip) = 805987ad167d8f9cac90e4b9342686e96a7708664111be27a3c6d680ce21d6c1
SIZE (ruby-1.8.7.zip) = 5851408

For a brief list of user visible changes and a full list of all changes, see the bundled files named NEWS and ChangeLog, which are also available at the following locations:

http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7/NEWS
http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7/ChangeLog

Server maintenance

Thu, 22 May 2008 09:37:31 GMT

Services on ruby-lang.org except SVN will be down for server maintenance on Fri May 23 02:00:00 UTC 2008. Sorry for inconvenience.