CVE-2014-5003 Ciborg gem for Ruby allows local users to write files and gain privileges via Symlink
MediumCVSS 5.5
EPSS 0.38%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
chef/travis-cookbooks/ci_environment/perlbrew/recipes/default.rb in the ciborg gem 3.0.0 for Ruby allows local users to write to arbitrary files and gain privileges via a symlink attack on /tmp/perlbrew-installer.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems ciborg(RubyGems) | = 3.0.0 | No fix listed |
| ciborg project ciborg | = 3.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- [oss-security] 20140707 Vulnerability Report for Ruby Gem ciborg-3.0.0 mailing-list third-party-advisory
- [oss-security] 20140717 Re: Vulnerability Report for Ruby Gem codders-dataset-1.3.2.1 (etc.) mailing-list third-party-advisory
- www.vapid.dhs.org third-party-advisory
- github.com exploit