Ruby 新闻

Arbitrary code execution vulnerabilities

Fri, 20 Jun 2008 12:54:43 GMT

Multiple vulnerabilities in Ruby may lead to a denial of service (DoS) condition or allow execution of arbitrary code.

Impact

With the following vulnerabilities, an attacker can lead to denial of service condition or execute arbitrary code.

Vulnerable versions

1.8 series

1.8.4 and all prior versions
1.8.5-p230 and all prior versions
1.8.6-p229 and all prior versions
1.8.7-p21 and all prior versions

1.9 series

1.9.0-1 and all prior versions

Solution

1.8 series

Please upgrade to 1.8.5-p231, or 1.8.6-p230, or 1.8.7-p22.

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p231.tar.gz> (md5sum: e900cf225d55414bffe878f00a85807c)
<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p230.tar.gz> (md5sum: 5e8247e39be2dc3c1a755579c340857f)
<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p22.tar.gz> (md5sum: fc3ede83a98f48d8cb6de2145f680ef2)

1.9 series

Please upgrade to 1.9.0-2.

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.0-2.tar.gz> (md5sum: 2a848b81ed1d6393b88eec8aa6173b75)

These versions also fix the vulnerability of WEBrick (CVE-2008-1891).

Please note that a package that corrects this weakness may already be available through your package management software.

Credit

Credit to Drew Yao of Apple Product Security for disclosing the problem to Ruby Security Team.

Changes

2008-06-21 00:29 +09:00 removed wrong CVE IDs (CVE-2008-2727, CVE-2008-2728).

RubyNation 2008

Mon, 16 Jun 2008 22:05:00 GMT

RubyNation is an annual Ruby conference serving the Virginia, West Virginia, Maryland, and Washington, DC areas. This year's RubyNation will happen on August 1&2, 2008 in Herndon, VA. Please visit the RubyNation site for more details.

Ruby 1.8.7 has been released

Sat, 31 May 2008 16:55:58 GMT

Akinori MUSHA announced today that Ruby 1.8.7 has been released.

The new version of Ruby includes many bug fixes, lots of feature enhancements backported from 1.9 and some performance improvements since 1.8.6 while maintaining stability and backward compatibility with the previous release to a high degree. See the bundled documentation for details about compatibility issues.

The source code package is available in three formats at the following locations:

Checksums:

MD5 (ruby-1.8.7.tar.bz2) = f17f14c8d55e731b3ce1bc35c42f0a6c
SHA256 (ruby-1.8.7.tar.bz2) = 65f2a862ba5e88bac7a78cff15bcb88d7534e741b51a1ffb79a0136c7041359a
SIZE (ruby-1.8.7.tar.bz2) = 4100024

MD5 (ruby-1.8.7.tar.gz) = de906850f9a012c12ffc6e9f56fb1b66
SHA256 (ruby-1.8.7.tar.gz) = 600dccf13bca3e4179fa6ff554220ce4ba67ffc72bce1ac3bf74c2599c03a0ca
SIZE (ruby-1.8.7.tar.gz) = 4799732

MD5 (ruby-1.8.7.zip) = 14d3eb37b32e4a26966bdd80f361ccd2
SHA256 (ruby-1.8.7.zip) = 805987ad167d8f9cac90e4b9342686e96a7708664111be27a3c6d680ce21d6c1
SIZE (ruby-1.8.7.zip) = 5851408

For a brief list of user visible changes and a full list of all changes, see the bundled files named NEWS and ChangeLog, which are also available at the following locations:

http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7/NEWS
http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7/ChangeLog

Server maintenance

Thu, 22 May 2008 09:37:31 GMT

Services on ruby-lang.org except SVN will be down for server maintenance on Fri May 23 02:00:00 UTC 2008. Sorry for inconvenience.

Tulsa Ruby Workshop

Fri, 11 Apr 2008 16:31:11 GMT

I wanted to get the word out about the upcoming Tulsa Ruby Workshop. This will take place on April 26th, from 10 AM to 4 PM in Tulsa, OK.

The workshop has a great line up of intro Ruby and Rail content. I’m honored to have been asked to give two of the talks that day: an introduction to Ruby talk as well as a Ruby from Java talk. There will also be a beginning Rails talk from Tulsa.rb’s commander and chief, an Engine Yard employee on hand sharing deployment advice, as well as other language specific migration talks.

That’s pretty much a full day of Ruby learning and the best news is that attendance is free. They are even throwing in some food.

If you’re going to be in the area, definitely come join us!

You can find directions, a schedule, and other details about the workshop at:

http://tulsarb.org/wiki/Tulsa_Ruby_Workshop

Hope to see you there.

File access vulnerability of WEBrick

Mon, 03 Mar 2008 15:00:28 GMT

WEBrick, a standard library of Ruby to implement HTTP servers, has file access vulnerability.

Impact

The following programs are vulnerable.

Programs that publish files using WEBrick::HTTPServer.new with the :DocumentRoot option
Programs that publish files using WEBrick::HTTPServlet::FileHandler

Affected systems are:

Systems that accept backslash (\) as a path separator, such as Windows.
Systems that use case insensitive filesystems such as NTFS on Windows, HFS on Mac OS X.

This vulnerability has the following impacts.

Attacker can access private files by sending a url with url encoded backslash (\). This exploit works only on systems that accept backslash as a path separator.

Example:
```
http://[server]:[port]/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/boot.ini
```
Attacker can access files that matches to the patterns specified by the :NondisclosureName option (the default value is [".ht*", "*~"]). This exploit works only on systems that use case insensitive filesystems.

Vulnerable versions

1.8 series

1.8.4 and all prior versions
1.8.5-p114 and all prior versions
1.8.6-p113 and all prior versions

1.9 series

1.9.0-1 and all prior versions

Solution

1.8 series

Please upgrade to 1.8.5-p115 or 1.8.6-p114.

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.5-p115.tar.gz> (md5sum: 20ca6cc87eb077296806412feaac0356)
<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p114.tar.gz> (md5sum: 500a9f11613d6c8ab6dcf12bec1b3ed3)

1.9 series

Please apply the following patch to lib/webrick/httpservlet/filehandler.rb.

<URL:ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.0-1-webrick-vulnerability-fix.diff> (md5sum: b7b58aed40fa1609a67f53cfd3a13257)

Please note that a package that corrects this weakness may already be available through your package management software.

Credit

Credit to Digital Security Research Group (<URL:http://dsec.ru/>) for disclosing the problem to Ruby Security Team.

Scotland on Rails 2008

Wed, 27 Feb 2008 14:48:20 GMT

Scotland on Rails is pleased to announce that Conference2008 is open for registration. There is a limit to the number of registrations we’re able to accept so we’d advise you to get in quickly :-)

You can register at http://scotlandonrails.com/register The conference will take place on April 4th and 5th in Edinburgh (in a castle!), Scotland and will feature speakers from the UK, Europe, US and New Zealand including keynotes from Michael Koziarski and David Black. A list of sessions and speakers is available at http://scotlandonrails.com/talks.

We’re also planning a charity event on Thursday 3rd. This will feature an beginner level intro to Ruby and Rails in the morning, and sessions from several of the speakers from the main conference (including Jim Weirich, Bruce Williams and Giles Bowkett) in the afternoon. All the money raised from that days event will be going to CHAS – The Childrens Hospice Association.

European Ruby Confrence 2008 (EURUKO)

Mon, 25 Feb 2008 15:33:16 GMT

EURUKO is an annual conference about the Ruby programming language with an informal atmosphere and lots of opportunities to listen, to talk, to hack and to have fun. This year it takes place in Prague, Czech Republic, on March 29th to 30th.

MountainWest RubyConf 2008

Mon, 04 Feb 2008 18:24:11 GMT

Registration for MountainWest RubyConf 2008 is now open. This year features an expanded schedule and list of speakers.

The conference will be in Salt Lake City, Utah, USA, on March 28 and 29, 2008. Registration costs just $100 and includes lunch both days, t-shirt, and more.

Ruby Fool's Conference

Thu, 24 Jan 2008 14:24:47 GMT

The first Ruby Fools conference will be held on April Fools’ Day in Copenhagen, Denmark. The conference organizers intend to cater a bit to both expert and novice developers, so any Rubyists in the area may want to consider attending.