On Fri Jun 17 2005, a vulnerability of XMLRPC.iPIMethods was reported in
\[ruby-core:05237\]. Remote attackers can execute arbitrary commands by
this vulnerability.

#### Affected Programs

Programs providing XML-RPC services by XMLRPC.iPIMethods are affected.

#### Fix

This vulnerability was already fixed in both the CVS HEAD and the
ruby\_1\_8 branch.

Please apply this patch for ruby-1.8.2.

* www.ruby-lang.org/patches/ruby-1.8.2-xmlrpc-ipimethods-fix.diff
^

    --- ruby-1.8.2/lib/xmlrpc/utils.rb.orig 2003-08-15 02:20:14.000000000 +0900
    +++ ruby-1.8.2/lib/xmlrpc/utils.rb      2005-07-01 16:33:19.243521736 +0900
    @@ -138,7 +138,7 @@
     
         def get_methods(obj, delim=".")
           prefix = @prefix + delim
    -      obj.class.public_instance_methods.collect { |name|
    +      obj.class.public_instance_methods(false).collect { |name|
             [prefix + name, obj.method(name).to_proc, nil, nil] 
           }
         end
{: .code}