oss-sec mailing list archives
Re: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem
From: cve-assign () mitre org
Date: Wed, 12 Mar 2014 07:10:46 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
http://www.vapid.dhs.org/advisories/arabic-ruby-gem.html
In Arabic-Prawn-0.0.1/lib/string_utf_support.rb
If the downloaded file name #{downloaded_file} or #{url} contains any shell meta characters like ';' a malicious user can inject shell commands.
Use CVE-2014-2322. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTID8nAAoJEKllVAevmvmsqx0IAJT0oDoDBciWG/V8tcBBv471 Pbn3SCXaT0Hxh6/hGgHDAJT9qxYjLloP18Go8/j5w38QGkyQHtDSj+IvMNRWwIU0 z8byXV7Ar1GoqcdZGugerGEFWRdrqdRGyoSsYbjD3NJpziP+YY/lUE5iQZd5jF0S iCENnwLZuJe1q9nz5T+N1clq7Lt+j5T271/A91HrpPWl8KO4brEdC3nP2mqaagkE p7a5VyJUUdIm2/bQKZeVbGqe2S+PsJhBV+6da7+56u8NOAA0GMUYYM/b3431SZDq ZGPdcvUu55WHZwXSuulzM+n5S5Y0MkMDuN7FGD9WZpvbAczyxwMEeEMaK3iKNT4= =/MsD -----END PGP SIGNATURE-----
Current thread:
- Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem Larry W. Cashdollar (Mar 10)
- Re: Remote Command Injection in Arabic Prawn 0.0.1 Ruby Gem cve-assign (Mar 12)