Secunia

Two vulnerabilities have been reported in Ruby, which can be exploited by malicious people to bypass certain security restrictions, and to cause a DoS (Denial of Service).

1) An error exists in "eval.c" when enforcing safe-level protections. This can be exploited to execute certain insecure methods.

The vulnerability has been reported in the following versions:
* Ruby version 1.6.8 and prior (old release).
* Ruby version 1.8.2 and prior (stable).
* Ruby version 1.9.0 2005-09-01 and prior (development).

2) An error within the XMLRPC::Server and WEBrick::HTTPServer classes can cause a server that is written using the classes to stop accept connections via a specially-crafted request that causes the server block on a socket operation.

The vulnerability has been reported in the following versions:
* Ruby version 1.8.2 and prior (stable).
* Ruby version 1.9.0 prior to 2005-07-10 (development).

Solution
Update to the fixed versions.
Further details available in Customer Area

Provided and/or discovered by
The vendor credits Dr. Yutaka Oiwa and Mr. Tanaka Tetsu, Research Center for Information Security, National Institute of Advanced Industrial Science and Technology.

Changelog
Further details available in Customer Area

Original Advisory
http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-dev/27787

JP Vendor Status Notes (Japanese):
http://jvn.jp/jp/JVN%2362914675/243894/index.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area