Vulnerabilities > CVE-2017-17405 - OS Command Injection vulnerability in multiple products

047910
CVSS 9.3 - CRITICAL
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
ruby-lang
debian
redhat
CWE-78
critical
nessus
exploit available

Summary

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default value of localfile is File.basename(remotefile), so malicious FTP servers could cause arbitrary command execution.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
  • Command Delimiters
    An attack of this type exploits a programs' vulnerabilities that allows an attacker's commands to be concatenated onto a legitimate command with the intent of targeting other resources such as the file system or database. The system that uses a filter or a blacklist input validation, as opposed to whitelist validation is vulnerable to an attacker who predicts delimiters (or combinations of delimiters) not present in the filter or blacklist. As with other injection attacks, the attacker uses the command delimiter payload as an entry point to tunnel through the application and activate additional attacks through SQL queries, shell commands, network scanning, and so on.
  • Exploiting Multiple Input Interpretation Layers
    An attacker supplies the target software with input data that contains sequences of special characters designed to bypass input validation logic. This exploit relies on the target making multiples passes over the input data and processing a "layer" of special characters with each pass. In this manner, the attacker can disguise input that would otherwise be rejected as invalid by concealing it with layers of special/escape characters that are stripped off by subsequent processing steps. The goal is to first discover cases where the input validation layer executes before one or more parsing layers. That is, user input may go through the following logic in an application: In such cases, the attacker will need to provide input that will pass through the input validator, but after passing through parser2, will be converted into something that the input validator was supposed to stop.
  • Argument Injection
    An attacker changes the behavior or state of a targeted application through injecting data or command syntax through the targets use of non-validated and non-filtered arguments of exposed services or methods.
  • OS Command Injection
    In this type of an attack, an adversary injects operating system commands into existing application functions. An application that uses untrusted input to build command strings is vulnerable. An adversary can leverage OS command injection in an application to elevate privileges, execute arbitrary commands and compromise the underlying operating system.

Exploit-Db

descriptionRuby < 2.2.8 / < 2.3.5 / < 2.4.2 / < 2.5.0-preview1 - 'NET::Ftp' Command Injection. CVE-2017-17405. Local exploit for Ruby platform
fileexploits/ruby/local/43381.md
idEDB-ID:43381
last seen2017-12-30
modified2017-12-02
platformruby
port
published2017-12-02
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/43381/
titleRuby < 2.2.8 / < 2.3.5 / < 2.4.2 / < 2.5.0-preview1 - 'NET::Ftp' Command Injection
typelocal

Nessus

  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1029.NASL
    descriptionAccording to the version of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a
    last seen2020-05-06
    modified2018-01-29
    plugin id106404
    published2018-01-29
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/106404
    titleEulerOS 2.0 SP1 : ruby (EulerOS-SA-2018-1029)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(106404);
      script_version("3.10");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/05/04");
    
      script_cve_id(
        "CVE-2017-17790"
      );
    
      script_name(english:"EulerOS 2.0 SP1 : ruby (EulerOS-SA-2018-1029)");
      script_summary(english:"Checks the rpm output for the updated package.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote EulerOS host is missing a security update.");
      script_set_attribute(attribute:"description", value:
    "According to the version of the ruby packages installed, the EulerOS
    installation on the remote host is affected by the following
    vulnerability :
    
      - The lazy_initialize function in lib/resolv.rb in Ruby
        through 2.4.3 uses Kernel#open, which might allow
        Command Injection attacks, as demonstrated by a
        Resolv::Hosts::new argument beginning with a '|'
        character, a different vulnerability than
        CVE-2017-17405. NOTE: situations with untrusted input
        may be highly unlikely.(CVE-2017-17790)
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the EulerOS security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues.");
      # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1029
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?59836119");
      script_set_attribute(attribute:"solution", value:
    "Update the affected ruby package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2018/01/25");
      script_set_attribute(attribute:"plugin_publication_date", value:"2018/01/29");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby-irb");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:huawei:euleros:ruby-libs");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:huawei:euleros:2.0");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Huawei Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/EulerOS/release", "Host/EulerOS/rpm-list", "Host/EulerOS/sp");
      script_exclude_keys("Host/EulerOS/uvp_version");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    
    release = get_kb_item("Host/EulerOS/release");
    if (isnull(release) || release !~ "^EulerOS") audit(AUDIT_OS_NOT, "EulerOS");
    if (release !~ "^EulerOS release 2\.0(\D|$)") audit(AUDIT_OS_NOT, "EulerOS 2.0");
    
    sp = get_kb_item("Host/EulerOS/sp");
    if (isnull(sp) || sp !~ "^(1)$") audit(AUDIT_OS_NOT, "EulerOS 2.0 SP1");
    
    uvp = get_kb_item("Host/EulerOS/uvp_version");
    if (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, "EulerOS 2.0 SP1", "EulerOS UVP " + uvp);
    
    if (!get_kb_item("Host/EulerOS/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "aarch64" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "EulerOS", cpu);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_ARCH_NOT, "i686 / x86_64", cpu);
    
    flag = 0;
    
    pkgs = ["ruby-2.0.0.353-23.h5",
            "ruby-irb-2.0.0.353-23.h5",
            "ruby-libs-2.0.0.353-23.h5"];
    
    foreach (pkg in pkgs)
      if (rpm_check(release:"EulerOS-2.0", sp:"1", reference:pkg)) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : rpm_report_get()
      );
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "ruby");
    }
    
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2018-2_0-0011-A.NASL
    descriptionAn update of {'ruby', 'glibc'} packages of Photon OS has been released.
    last seen2019-02-21
    modified2019-02-07
    plugin id111281
    published2018-07-24
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=111281
    titlePhoton OS 2.0 : ruby / glibc (PhotonOS-PHSA-2018-2.0-0011-(a)) (deprecated)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2018-1_0-0098-A.NASL
    descriptionAn update of 'ruby', 'glibc' packages of Photon OS has been released.
    last seen2019-02-08
    modified2019-02-07
    plugin id111910
    published2018-08-17
    reporterTenable
    sourcehttps://www.tenable.com/plugins/index.php?view=single&id=111910
    titlePhoton OS 1.0: Glibc / Ruby PHSA-2018-1.0-0098-(a) (deprecated)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1248.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a
    last seen2020-06-01
    modified2020-06-02
    plugin id117557
    published2018-09-18
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/117557
    titleEulerOS Virtualization 2.5.0 : ruby (EulerOS-SA-2018-1248)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2018-0378.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with specially crafted names using the Net::FTP module. (CVE-2017-17405) * A buffer underflow was found in ruby
    last seen2020-06-01
    modified2020-06-02
    plugin id107082
    published2018-03-01
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/107082
    titleRHEL 7 : ruby (RHSA-2018:0378)
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2018-2_0-0011-A_RUBY.NASL
    descriptionAn update of the ruby package has been released.
    last seen2020-03-17
    modified2019-02-07
    plugin id121908
    published2019-02-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121908
    titlePhoton OS 2.0: Ruby PHSA-2018-2.0-0011-(a)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2019-1407.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with specially crafted names using the Net::FTP module.(CVE-2017-17405) - The
    last seen2020-06-01
    modified2020-06-02
    plugin id124910
    published2019-05-14
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124910
    titleEulerOS Virtualization for ARM 64 3.0.1.0 : ruby (EulerOS-SA-2019-1407)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1067.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with specially crafted names using the Net::FTP module. (CVE-2017-17405) - A buffer underflow was found in ruby
    last seen2020-05-06
    modified2018-03-20
    plugin id108471
    published2018-03-20
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108471
    titleEulerOS 2.0 SP2 : ruby (EulerOS-SA-2018-1067)
  • NASL familyFreeBSD Local Security Checks
    NASL idFREEBSD_PKG_DD644964E10E11E780970800271D4B9C.NASL
    descriptionEtienne Stalmans from the Heroku product security team reports : There is a command injection vulnerability in Net::FTP bundled with Ruby. Net::FTP#get, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the pipe character
    last seen2020-06-01
    modified2020-06-02
    plugin id105363
    published2017-12-19
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105363
    titleFreeBSD : ruby -- Command injection vulnerability in Net::FTP (dd644964-e10e-11e7-8097-0800271d4b9c)
  • NASL familyRed Hat Local Security Checks
    NASL idREDHAT-RHSA-2019-2806.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7.3 Advanced Update Support, Red Hat Enterprise Linux 7.3 Telco Extended Update Support, and Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * ruby: Command injection vulnerability in Net::FTP (CVE-2017-17405) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
    last seen2020-06-01
    modified2020-06-02
    plugin id129040
    published2019-09-19
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/129040
    titleRHEL 7 : ruby (RHSA-2019:2806)
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1030.NASL
    descriptionAccording to the version of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open, which might allow Command Injection attacks, as demonstrated by a Resolv::Hosts::new argument beginning with a
    last seen2020-05-06
    modified2018-01-29
    plugin id106405
    published2018-01-29
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/106405
    titleEulerOS 2.0 SP2 : ruby (EulerOS-SA-2018-1030)
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-3515-1.NASL
    descriptionIt was discovered that Ruby allows FTP command injection. An attacker could use this to cause arbitrary command execution. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id105583
    published2018-01-04
    reporterUbuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105583
    titleUbuntu 14.04 LTS / 16.04 LTS / 17.04 / 17.10 : ruby1.9.1, ruby2.0, ruby2.3 vulnerability (USN-3515-1)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1221.NASL
    descriptionSeveral vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2017-17405 A command injection vulnerability in Net::FTP might allow a malicious FTP server the execution of arbitrary commands. CVE-2017-17790 A command injection vulnerability in lib/resolv.rb
    last seen2020-03-17
    modified2017-12-26
    plugin id105428
    published2017-12-26
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/105428
    titleDebian DLA-1221-1 : ruby1.9.1 security update
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2018-004.NASL
    descriptionThe remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities.
    last seen2020-06-01
    modified2020-06-02
    plugin id111136
    published2018-07-17
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111136
    titlemacOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-004)
  • NASL familyNewStart CGSL Local Security Checks
    NASL idNEWSTART_CGSL_NS-SA-2019-0013_RUBY.NASL
    descriptionThe remote NewStart CGSL host, running version MAIN 5.04, has ruby packages installed that are affected by multiple vulnerabilities: - A buffer overflow vulnerability was found in the JSON extension of ruby. An attacker with the ability to pass a specially crafted JSON input to the extension could use this flaw to expose the interpreter
    last seen2020-06-01
    modified2020-06-02
    plugin id127164
    published2019-08-12
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/127164
    titleNewStart CGSL MAIN 5.04 : ruby Multiple Vulnerabilities (NS-SA-2019-0013)
  • NASL familyScientific Linux Local Security Checks
    NASL idSL_20180228_RUBY_ON_SL7_X.NASL
    descriptionSecurity Fix(es) : - It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with specially crafted names using the Net::FTP module. (CVE-2017-17405) - A buffer underflow was found in ruby
    last seen2020-03-18
    modified2018-03-01
    plugin id107084
    published2018-03-01
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/107084
    titleScientific Linux Security Update : ruby on SL7.x x86_64 (20180228)
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201802-05.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201802-05 (Ruby: Command injection) A command injection flaw was discovered in Net::FTP which impacts Ruby. Impact : A remote attacker, by enticing a user to download and open a crafted file from a malicious FTP server, could execute arbitrary commands with the privileges of the process. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id106886
    published2018-02-20
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/106886
    titleGLSA-201802-05 : Ruby: Command injection
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1421.NASL
    descriptionMultiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2015-9096 SMTP command injection in Net::SMTP via CRLF sequences in a RCPT TO or MAIL FROM command. CVE-2016-2339 Exploitable heap overflow in Fiddle::Function.new. CVE-2016-7798 Incorrect handling of initialization vector in the GCM mode in the OpenSSL extension. CVE-2017-0898 Buffer underrun vulnerability in Kernel.sprintf. CVE-2017-0899 ANSI escape sequence vulnerability in RubyGems. CVE-2017-0900 DoS vulnerability in the RubyGems query command. CVE-2017-0901 gem installer allowed a malicious gem to overwrite arbitrary files. CVE-2017-0902 RubyGems DNS request hijacking vulnerability. CVE-2017-0903 Max Justicz reported that RubyGems is prone to an unsafe object deserialization vulnerability. When parsed by an application which processes gems, a specially crafted YAML formatted gem specification can lead to remote code execution. CVE-2017-10784 Yusuke Endoh discovered an escape sequence injection vulnerability in the Basic authentication of WEBrick. An attacker can take advantage of this flaw to inject malicious escape sequences to the WEBrick log and potentially execute control characters on the victim
    last seen2020-06-01
    modified2020-06-02
    plugin id111081
    published2018-07-16
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111081
    titleDebian DLA-1421-1 : ruby2.1 security update
  • NASL familyHuawei Local Security Checks
    NASL idEULEROS_SA-2018-1066.NASL
    descriptionAccording to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with specially crafted names using the Net::FTP module. (CVE-2017-17405) - A buffer underflow was found in ruby
    last seen2020-05-06
    modified2018-03-20
    plugin id108470
    published2018-03-20
    reporterThis script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/108470
    titleEulerOS 2.0 SP1 : ruby (EulerOS-SA-2018-1066)
  • NASL familyCentOS Local Security Checks
    NASL idCENTOS_RHSA-2018-0378.NASL
    descriptionAn update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with specially crafted names using the Net::FTP module. (CVE-2017-17405) * A buffer underflow was found in ruby
    last seen2020-06-01
    modified2020-06-02
    plugin id107270
    published2018-03-12
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/107270
    titleCentOS 7 : ruby (CESA-2018:0378)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DLA-1222.NASL
    descriptionSeveral vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems : CVE-2017-17405 A command injection vulnerability in Net::FTP might allow a malicious FTP server the execution of arbitrary commands. CVE-2017-17790 A command injection vulnerability in lib/resolv.rb
    last seen2020-03-17
    modified2017-12-26
    plugin id105429
    published2017-12-26
    reporterThis script is Copyright (C) 2017-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/105429
    titleDebian DLA-1222-1 : ruby1.8 security update
  • NASL familyPhotonOS Local Security Checks
    NASL idPHOTONOS_PHSA-2018-1_0-0098-A_RUBY.NASL
    descriptionAn update of the ruby package has been released.
    last seen2020-03-17
    modified2019-02-07
    plugin id121799
    published2019-02-07
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121799
    titlePhoton OS 1.0: Ruby PHSA-2018-1.0-0098-(a)
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4259.NASL
    descriptionSeveral vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in incorrect processing of HTTP/FTP, directory traversal, command injection, unintended socket creation or information disclosure. This update also fixes several issues in RubyGems which could allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code.
    last seen2020-06-01
    modified2020-06-02
    plugin id111468
    published2018-08-02
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111468
    titleDebian DSA-4259-1 : ruby2.3 - security update
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_10_13_6.NASL
    descriptionThe remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6. It is, therefore, affected by multiple vulnerabilities. Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id111137
    published2018-07-17
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/111137
    titlemacOS 10.13.x < 10.13.6 Multiple Vulnerabilities
  • NASL familyMacOS X Local Security Checks
    NASL idMACOSX_SECUPD2018-005.NASL
    descriptionThe remote host is running Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components : - afpserver - AppleGraphicsControl - APR - ATS - CFNetwork - CoreAnimation - CoreCrypto - CoreFoundation - CUPS - Dictionary - dyld - Foundation - Heimdal - Hypervisor - ICU - Intel Graphics Driver - IOGraphics - IOHIDFamily - IOKit - IOUserEthernet - IPSec - Kernel - Login Window - mDNSOffloadUserClient - MediaRemote - Microcode - Perl - Ruby - Security - Spotlight - Symptom Framework - WiFi
    last seen2020-06-01
    modified2020-06-02
    plugin id118573
    published2018-10-31
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/118573
    titlemacOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-005)
  • NASL familyOracle Linux Local Security Checks
    NASL idORACLELINUX_ELSA-2018-0378.NASL
    descriptionFrom Red Hat Security Advisory 2018:0378 : An update for ruby is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es) : * It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with specially crafted names using the Net::FTP module. (CVE-2017-17405) * A buffer underflow was found in ruby
    last seen2020-06-01
    modified2020-06-02
    plugin id107080
    published2018-03-01
    reporterThis script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/107080
    titleOracle Linux 7 : ruby (ELSA-2018-0378)
  • NASL familySlackware Local Security Checks
    NASL idSLACKWARE_SSA_2017-353-01.NASL
    descriptionNew ruby packages are available for Slackware 14.2 and -current to fix a security issue.
    last seen2020-06-01
    modified2020-06-02
    plugin id105377
    published2017-12-20
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/105377
    titleSlackware 14.2 / current : ruby (SSA:2017-353-01)

Redhat

advisories
  • rhsa
    idRHSA-2018:0378
  • rhsa
    idRHSA-2018:0583
  • rhsa
    idRHSA-2018:0584
  • rhsa
    idRHSA-2018:0585
  • rhsa
    idRHSA-2019:2806
rpms
  • ruby-0:2.0.0.648-33.el7_4
  • ruby-debuginfo-0:2.0.0.648-33.el7_4
  • ruby-devel-0:2.0.0.648-33.el7_4
  • ruby-doc-0:2.0.0.648-33.el7_4
  • ruby-irb-0:2.0.0.648-33.el7_4
  • ruby-libs-0:2.0.0.648-33.el7_4
  • ruby-tcltk-0:2.0.0.648-33.el7_4
  • rubygem-bigdecimal-0:1.2.0-33.el7_4
  • rubygem-io-console-0:0.4.2-33.el7_4
  • rubygem-json-0:1.7.7-33.el7_4
  • rubygem-minitest-0:4.3.2-33.el7_4
  • rubygem-psych-0:2.0.0-33.el7_4
  • rubygem-rake-0:0.9.6-33.el7_4
  • rubygem-rdoc-0:4.0.0-33.el7_4
  • rubygems-0:2.0.14.1-33.el7_4
  • rubygems-devel-0:2.0.14.1-33.el7_4
  • rh-ruby22-ruby-0:2.2.9-19.el6
  • rh-ruby22-ruby-0:2.2.9-19.el7
  • rh-ruby22-ruby-debuginfo-0:2.2.9-19.el6
  • rh-ruby22-ruby-debuginfo-0:2.2.9-19.el7
  • rh-ruby22-ruby-devel-0:2.2.9-19.el6
  • rh-ruby22-ruby-devel-0:2.2.9-19.el7
  • rh-ruby22-ruby-doc-0:2.2.9-19.el6
  • rh-ruby22-ruby-doc-0:2.2.9-19.el7
  • rh-ruby22-ruby-irb-0:2.2.9-19.el6
  • rh-ruby22-ruby-irb-0:2.2.9-19.el7
  • rh-ruby22-ruby-libs-0:2.2.9-19.el6
  • rh-ruby22-ruby-libs-0:2.2.9-19.el7
  • rh-ruby22-ruby-tcltk-0:2.2.9-19.el6
  • rh-ruby22-ruby-tcltk-0:2.2.9-19.el7
  • rh-ruby22-rubygem-bigdecimal-0:1.2.6-19.el6
  • rh-ruby22-rubygem-bigdecimal-0:1.2.6-19.el7
  • rh-ruby22-rubygem-io-console-0:0.4.3-19.el6
  • rh-ruby22-rubygem-io-console-0:0.4.3-19.el7
  • rh-ruby22-rubygem-json-0:1.8.1.1-19.el6
  • rh-ruby22-rubygem-json-0:1.8.1.1-19.el7
  • rh-ruby22-rubygem-minitest-0:5.4.3-19.el6
  • rh-ruby22-rubygem-minitest-0:5.4.3-19.el7
  • rh-ruby22-rubygem-power_assert-0:0.2.2-19.el6
  • rh-ruby22-rubygem-power_assert-0:0.2.2-19.el7
  • rh-ruby22-rubygem-psych-0:2.0.8.1-19.el6
  • rh-ruby22-rubygem-psych-0:2.0.8.1-19.el7
  • rh-ruby22-rubygem-rake-0:10.4.2-19.el6
  • rh-ruby22-rubygem-rake-0:10.4.2-19.el7
  • rh-ruby22-rubygem-rdoc-0:4.2.0-19.el6
  • rh-ruby22-rubygem-rdoc-0:4.2.0-19.el7
  • rh-ruby22-rubygem-test-unit-0:3.0.8-19.el6
  • rh-ruby22-rubygem-test-unit-0:3.0.8-19.el7
  • rh-ruby22-rubygems-0:2.4.5.4-19.el6
  • rh-ruby22-rubygems-0:2.4.5.4-19.el7
  • rh-ruby22-rubygems-devel-0:2.4.5.4-19.el6
  • rh-ruby22-rubygems-devel-0:2.4.5.4-19.el7
  • rh-ruby24-ruby-0:2.4.3-90.el6
  • rh-ruby24-ruby-0:2.4.3-90.el7
  • rh-ruby24-ruby-debuginfo-0:2.4.3-90.el6
  • rh-ruby24-ruby-debuginfo-0:2.4.3-90.el7
  • rh-ruby24-ruby-devel-0:2.4.3-90.el6
  • rh-ruby24-ruby-devel-0:2.4.3-90.el7
  • rh-ruby24-ruby-doc-0:2.4.3-90.el6
  • rh-ruby24-ruby-doc-0:2.4.3-90.el7
  • rh-ruby24-ruby-irb-0:2.4.3-90.el6
  • rh-ruby24-ruby-irb-0:2.4.3-90.el7
  • rh-ruby24-ruby-libs-0:2.4.3-90.el6
  • rh-ruby24-ruby-libs-0:2.4.3-90.el7
  • rh-ruby24-rubygem-bigdecimal-0:1.3.0-90.el6
  • rh-ruby24-rubygem-bigdecimal-0:1.3.0-90.el7
  • rh-ruby24-rubygem-did_you_mean-0:1.1.0-90.el6
  • rh-ruby24-rubygem-did_you_mean-0:1.1.0-90.el7
  • rh-ruby24-rubygem-io-console-0:0.4.6-90.el6
  • rh-ruby24-rubygem-io-console-0:0.4.6-90.el7
  • rh-ruby24-rubygem-json-0:2.0.4-90.el6
  • rh-ruby24-rubygem-json-0:2.0.4-90.el7
  • rh-ruby24-rubygem-minitest-0:5.10.1-90.el6
  • rh-ruby24-rubygem-minitest-0:5.10.1-90.el7
  • rh-ruby24-rubygem-net-telnet-0:0.1.1-90.el6
  • rh-ruby24-rubygem-net-telnet-0:0.1.1-90.el7
  • rh-ruby24-rubygem-openssl-0:2.0.5-90.el6
  • rh-ruby24-rubygem-openssl-0:2.0.5-90.el7
  • rh-ruby24-rubygem-power_assert-0:0.4.1-90.el6
  • rh-ruby24-rubygem-power_assert-0:0.4.1-90.el7
  • rh-ruby24-rubygem-psych-0:2.2.2-90.el6
  • rh-ruby24-rubygem-psych-0:2.2.2-90.el7
  • rh-ruby24-rubygem-rake-0:12.0.0-90.el6
  • rh-ruby24-rubygem-rake-0:12.0.0-90.el7
  • rh-ruby24-rubygem-rdoc-0:5.0.0-90.el6
  • rh-ruby24-rubygem-rdoc-0:5.0.0-90.el7
  • rh-ruby24-rubygem-test-unit-0:3.2.3-90.el6
  • rh-ruby24-rubygem-test-unit-0:3.2.3-90.el7
  • rh-ruby24-rubygem-xmlrpc-0:0.2.1-90.el6
  • rh-ruby24-rubygem-xmlrpc-0:0.2.1-90.el7
  • rh-ruby24-rubygems-0:2.6.14-90.el6
  • rh-ruby24-rubygems-0:2.6.14-90.el7
  • rh-ruby24-rubygems-devel-0:2.6.14-90.el6
  • rh-ruby24-rubygems-devel-0:2.6.14-90.el7
  • rh-ruby23-ruby-0:2.3.6-67.el6
  • rh-ruby23-ruby-0:2.3.6-67.el7
  • rh-ruby23-ruby-debuginfo-0:2.3.6-67.el6
  • rh-ruby23-ruby-debuginfo-0:2.3.6-67.el7
  • rh-ruby23-ruby-devel-0:2.3.6-67.el6
  • rh-ruby23-ruby-devel-0:2.3.6-67.el7
  • rh-ruby23-ruby-doc-0:2.3.6-67.el6
  • rh-ruby23-ruby-doc-0:2.3.6-67.el7
  • rh-ruby23-ruby-irb-0:2.3.6-67.el6
  • rh-ruby23-ruby-irb-0:2.3.6-67.el7
  • rh-ruby23-ruby-libs-0:2.3.6-67.el6
  • rh-ruby23-ruby-libs-0:2.3.6-67.el7
  • rh-ruby23-ruby-tcltk-0:2.3.6-67.el6
  • rh-ruby23-ruby-tcltk-0:2.3.6-67.el7
  • rh-ruby23-rubygem-bigdecimal-0:1.2.8-67.el6
  • rh-ruby23-rubygem-bigdecimal-0:1.2.8-67.el7
  • rh-ruby23-rubygem-did_you_mean-0:1.0.0-67.el6
  • rh-ruby23-rubygem-did_you_mean-0:1.0.0-67.el7
  • rh-ruby23-rubygem-io-console-0:0.4.5-67.el6
  • rh-ruby23-rubygem-io-console-0:0.4.5-67.el7
  • rh-ruby23-rubygem-json-0:1.8.3.1-67.el6
  • rh-ruby23-rubygem-json-0:1.8.3.1-67.el7
  • rh-ruby23-rubygem-minitest-0:5.8.5-67.el6
  • rh-ruby23-rubygem-minitest-0:5.8.5-67.el7
  • rh-ruby23-rubygem-net-telnet-0:0.1.1-67.el6
  • rh-ruby23-rubygem-net-telnet-0:0.1.1-67.el7
  • rh-ruby23-rubygem-power_assert-0:0.2.6-67.el6
  • rh-ruby23-rubygem-power_assert-0:0.2.6-67.el7
  • rh-ruby23-rubygem-psych-0:2.1.0.1-67.el6
  • rh-ruby23-rubygem-psych-0:2.1.0.1-67.el7
  • rh-ruby23-rubygem-rake-0:10.4.2-67.el6
  • rh-ruby23-rubygem-rake-0:10.4.2-67.el7
  • rh-ruby23-rubygem-rdoc-0:4.2.1-67.el6
  • rh-ruby23-rubygem-rdoc-0:4.2.1-67.el7
  • rh-ruby23-rubygem-test-unit-0:3.1.5-67.el6
  • rh-ruby23-rubygem-test-unit-0:3.1.5-67.el7
  • rh-ruby23-rubygems-0:2.5.2.2-67.el6
  • rh-ruby23-rubygems-0:2.5.2.2-67.el7
  • rh-ruby23-rubygems-devel-0:2.5.2.2-67.el6
  • rh-ruby23-rubygems-devel-0:2.5.2.2-67.el7
  • ruby-0:2.0.0.648-30.el7_3
  • ruby-debuginfo-0:2.0.0.648-30.el7_3
  • ruby-devel-0:2.0.0.648-30.el7_3
  • ruby-doc-0:2.0.0.648-30.el7_3
  • ruby-irb-0:2.0.0.648-30.el7_3
  • ruby-libs-0:2.0.0.648-30.el7_3
  • ruby-tcltk-0:2.0.0.648-30.el7_3
  • rubygem-bigdecimal-0:1.2.0-30.el7_3
  • rubygem-io-console-0:0.4.2-30.el7_3
  • rubygem-json-0:1.7.7-30.el7_3
  • rubygem-minitest-0:4.3.2-30.el7_3
  • rubygem-psych-0:2.0.0-30.el7_3
  • rubygem-rake-0:0.9.6-30.el7_3
  • rubygem-rdoc-0:4.0.0-30.el7_3
  • rubygems-0:2.0.14.1-30.el7_3
  • rubygems-devel-0:2.0.14.1-30.el7_3

Seebug

bulletinFamilyexploit
descriptionThere is a command injection vulnerability in Net::FTP bundled with Ruby. This vulnerability has been assigned the CVE identifier [CVE-2017-17405](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17405). ### Details `Net::FTP#get`, `getbinaryfile`, `gettextfile`, `put`, `putbinaryfile`, and `puttextfile` use `Kernel#open` to open a local file. If the `localfile` argument starts with the pipe character "`|`", the command following the pipe character is executed. The default value of `localfile` is `File.basename(remotefile)`, so malicious FTP servers could cause arbitrary command execution. All users running an affected release should upgrade immediately. ### Affected Versions * Ruby 2.2 series: 2.2.8 and earlier * Ruby 2.3 series: 2.3.5 and earlier * Ruby 2.4 series: 2.4.2 and earlier * Ruby 2.5 series: 2.5.0-preview1 * prior to trunk revision r61242
idSSV:96996
last seen2017-12-25
modified2017-12-18
published2017-12-18
reporterRoot
titleCommand injection vulnerability in Net::FTP(CVE-2017-17405)