A security issue has been reported in Ruby, which can be exploited by malicious, local users to perform certain actions with escalated privileges.

The security issue is caused due to a race condition within the "FileUtils.remove_entry_secure" method, which can be exploited to delete arbitrary directories and files via symlink attacks.

The security issue is reported in versions 1.8.6 patchlevel 420 and prior, 1.8.7 patchlevel 330 and prior, 1.9.1 patchlevel 430 and prior, and 1.9.2 patchlevel 136 and prior.

Solution
Update to versions 1.8.7-334, 1.9.1-p431, or 1.9.2-p180.

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
Ruby:
http://www.ruby-lang.org/en/news/2011/02/18/fileutils-is-vulnerable-to-symlink-race-attacks/

Deep Links
Links available to Secunia VIM customers