CVE

Id
32008  
CVE No.
CVE-2008-1891  
Status
Candidate  
Description
Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option.  
Phase
Assigned (20080418)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
345282 32008 CVE-2008-1891 MISC:http://aluigi.altervista.org/adv/webrickcgi-adv.txt  View
345283 32008 CVE-2008-1891 CONFIRM:http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/  View
345284 32008 CVE-2008-1891 FEDORA:FEDORA-2008-5649  View
345285 32008 CVE-2008-1891 URL:https://www.redhat.com/archives/fedora-package-announce/2008-June/msg00937.html  View
345286 32008 CVE-2008-1891 MANDRIVA:MDVSA-2008:140  View
345287 32008 CVE-2008-1891 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2008:140  View
345288 32008 CVE-2008-1891 MANDRIVA:MDVSA-2008:141  View
345289 32008 CVE-2008-1891 URL:http://www.mandriva.com/security/advisories?name=MDVSA-2008:141  View
345290 32008 CVE-2008-1891 SUSE:SUSE-SR:2008:017  View
345291 32008 CVE-2008-1891 URL:http://lists.opensuse.org/opensuse-security-announce/2008-08/msg00006.html  View
345292 32008 CVE-2008-1891 VUPEN:ADV-2008-1245  View
345293 32008 CVE-2008-1891 URL:http://www.vupen.com/english/advisories/2008/1245/references  View
345294 32008 CVE-2008-1891 SECUNIA:29794  View
345295 32008 CVE-2008-1891 URL:http://secunia.com/advisories/29794  View
345296 32008 CVE-2008-1891 SECUNIA:30831  View
345297 32008 CVE-2008-1891 URL:http://secunia.com/advisories/30831  View
345298 32008 CVE-2008-1891 SECUNIA:31687  View
345299 32008 CVE-2008-1891 URL:http://secunia.com/advisories/31687  View
345300 32008 CVE-2008-1891 XF:ruby-webrick-cgi-info-disclosure(41824)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
47658 JVNDB-2008-002968 Carbon Communities における SQL インジェクションの脆弱性 Carbon Communities には、SQL インジェクションの脆弱性が存在します。 CVE-2008-1895 32008 7.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-002968.html  View