CVE-2008-1145 Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash () path separators or case-insensitiv...
MediumCVSS 5.0
EPSS 27.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash () path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) "..%5c" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ruby-lang webrick | All versions | No fix listed |
| fedoraproject fedora | = 7 | No fix listed |
| fedoraproject fedora | = 8 | No fix listed |
References
- APPLE-SA-2008-06-30 broken-link mailing-list vendor-advisory
- SUSE-SR:2008:017 mailing-list third-party-advisory vendor-advisory
- 29232 not-applicable third-party-advisory vendor-advisory
- 29357 not-applicable third-party-advisory vendor-advisory
- 29536 not-applicable third-party-advisory
- 30802 not-applicable third-party-advisory
- 31687 not-applicable third-party-advisory
- 32371 not-applicable third-party-advisory
- support.apple.com third-party-advisory
- wiki.rpath.com broken-link
- wiki.rpath.com broken-link
- VU#404515 third-party-advisory us-government-resource
- MDVSA-2008:141 broken-link vendor-advisory
- MDVSA-2008:142 broken-link vendor-advisory
- RHSA-2008:0897 third-party-advisory vendor-advisory
- www.ruby-lang.org exploit patch vendor-advisory
- 20080306 [DSECRG-08-018] Ruby 1.8.6 (Webrick Httpd 1.3.1) Directory traversal file Download Vulnerability mailing-list third-party-advisory vdb-entry
- 20080306 Re: [DSECRG-08-018] Ruby 1.8.6 (Webrick Httpd 1.3.1) Directory traversal file Download Vulnerability mailing-list third-party-advisory vdb-entry
- 20080325 rPSA-2008-0123-1 ruby mailing-list third-party-advisory vdb-entry
- 28123 broken-link third-party-advisory vdb-entry
- 1019562 broken-link third-party-advisory vdb-entry
- ADV-2008-0787 permissions-required vdb-entry
- ADV-2008-1981 permissions-required vdb-entry
- ruby-webrick-directory-traversal(41010) third-party-advisory vdb-entry
- issues.rpath.com broken-link
- oval:org.mitre.oval:def:10937 broken-link signature vdb-entry
- 5215 exploit third-party-advisory vdb-entry
- FEDORA-2008-2443 third-party-advisory vendor-advisory
- FEDORA-2008-2458 third-party-advisory vendor-advisory