Security Vulnerabilities in Safe Level, WEBrick, Dl, DNS lookup

| by Werner Schuster Follow 6 Followers on Aug 10, 2008. Estimated reading time: 1 minute |
A list of new security vulnerabilities in Ruby libraries and systems is available.

One issue is a problem with the safe levels. By setting a safe level, it's possible disallow certain operations and define what data is defined as tainted. Tainted data in Ruby must be explicitly untainted before use. The discovered vulnerabilities are:
  • untrace_var is permitted at safe level 4
  • $PROGRAM_NAME may be modified at safe level 4
  • Insecure methods may be called at safe level 1-3
  • Syslog operations are permitted at safe level 4
See the list of vulnerabilities for code samples. A related issue in dl is related to tainted data. The dl library allows to load dynamic libraries and invoke their functions. The dl library doesn't check the taintedness of arguments passed to the calls, which could be used in exploits.

Another vulnerability discovered is in WEBrick, which is susceptible to Denial of Service (DoS) attacks. The problem was caused by the code responsible for splitting HTTP headers - for certain data the regex engine would fail to terminate.

The recently discovered DNS security problem also affected Ruby and was solved by randomizing DNS transaction IDs and source ports.

The solution to these issues is an upgrade to 1.8.6-p286, or 1.8.7-p71 for 1.8.x. For users of Ruby 1.9.x, apparently the currently advised solution is to get the current version in the SVN repository - all revisions after r18423 should be safe.

Finally, a word of caution: the recently discovered problems in the Ruby interpreter were resolved - but the first versions that contained the fixes caused compatibility problems. It pays to properly testdrive the upgrades before putting them into production.

Upgrading to 1.8.7 is also a solution that might cause problems. Using Rails 2.0 with Ruby 1.8.7 can cause problems due to a method ActiveSupport added to String. Ruby 1.8.7 added this method to String by default - yet with slightly different semantics (see InfoQ's article on Ruby's Open Classes for other similar issues). Rails 2.1 works with Ruby 1.8.7.

Rate this Article

Adoption Stage

Hello stranger!

You need to Register an InfoQ account or or login to post comments. But there's so much more behind being registered.

Get the most out of the InfoQ experience.

Tell us what you think

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread
Community comments

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread

Allowed html: a,b,br,blockquote,i,li,pre,u,ul,p

Email me replies to any of my messages in this thread


Login to InfoQ to interact with what matters most to you.

Recover your password...


Follow your favorite topics and editors

Quick overview of most important highlights in the industry and on the site.


More signal, less noise

Build your own feed by choosing topics you want to read about and editors you want to hear from.


Stay up-to-date

Set up your notifications and don't miss out on content that matters to you