CVE

Id
23826  
CVE No.
CVE-2007-0469  
Status
Candidate  
Description
The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.  
Phase
Assigned (20070123)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
231865 23826 CVE-2007-0469 BUGTRAQ:20070121 RubyGems 0.9.0 and earlier installation exploit  View
231866 23826 CVE-2007-0469 URL:http://www.securityfocus.com/archive/1/archive/1/458128/100/0/threaded  View
231867 23826 CVE-2007-0469 FULLDISC:20070121 RubyGems 0.9.0 and earlier installation exploit  View
231868 23826 CVE-2007-0469 URL:http://marc.info/?l=full-disclosure&m=116939816621060&w=2  View
231869 23826 CVE-2007-0469 CONFIRM:http://rubyforge.org/frs/shownotes.php?release_id=9074  View
231870 23826 CVE-2007-0469 SUSE:SUSE-SR:2007:004  View
231871 23826 CVE-2007-0469 URL:http://www.novell.com/linux/security/advisories/2007_4_sr.html  View
231872 23826 CVE-2007-0469 VUPEN:ADV-2007-0295  View
231873 23826 CVE-2007-0469 URL:http://www.vupen.com/english/advisories/2007/0295  View
231874 23826 CVE-2007-0469 XF:rubygems-extractfiles-file-overwrite(31688)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
52500 JVNDB-2007-001192 Check Point Connectra NGX におけるセキュリティ要件を回避される脆弱性 Check Point Connectra NGX には、Report パラメータの処理に不備があるため、セキュリティ要件を回避される脆弱性が存在します。 CVE-2007-0471 23826 7.5 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001192.html  View