=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2009/VULN519
_____________________________________________________________________

DATE                      : 10/12/2009

HARDWARE PLATFORM(S)      : /

OPERATING SYSTEM(S)       : Systems running Ruby versions 1.9.1*.

======================================================================
http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/
______________________________________________________________________


Heap overflow in String

There is a heap overflow vulnerability in String#ljust, String#center
and String#rjust. This has allowed an attacker to run arbitrary code
in some rare cases.

    * CVE-2009-4124


Vulnerable versions

    * All releases of Ruby 1.9.1.

This vulnerability does not affect Ruby 1.8 series.


Solution

Please upgrade to Ruby 1.9.1-p376.

    * <URL:ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.1-p376.tar.bz2>


Credit

Credit to Emmanouel Kellinis, KPMG London for disclosing the problem
to Ruby Security team.


Changes

    * 2009-12-07 14:52 +0900 add link to CVE (but not opened yet
when writing this page)


======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================