製品・ソフトウェアに関する情報

JVN脆弱性詳細

Ruby の BigDecimal クラス内にある VpMemAlloc 関数における任意のコードを実行される脆弱性

Title	Ruby の BigDecimal クラス内にある VpMemAlloc 関数における任意のコードを実行される脆弱性
Summary	Ruby の BigDecimal クラス内にある bigdecimal.c の VpMemAlloc 関数には、メモリの割り当てを適切に行わないため、任意のコードを実行される、またはサービス運用妨害 (DoS) 状態となる脆弱性が存在します。
Possible impacts	攻撃者により、任意のコードを実行される、またはサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	March 23, 2011, midnight
Registration Date	April 25, 2011, 11:25 a.m.
Last Update	July 28, 2011, 10:08 a.m.

CVSS2.0 : 警告
Score	6.8
Vector	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected System

レッドハット

Red Hat Enterprise Linux Desktop 6

Red Hat Enterprise Linux HPC Node 6

Red Hat Enterprise Linux Server 6

Red Hat Enterprise Linux Server EUS 6.1.z

Red Hat Enterprise Linux Workstation 6

サイバートラスト株式会社

Asianux Server 3 (x86)

Asianux Server 3 (x86-64)

Asianux Server 4.0

Asianux Server 4.0 (x86-64)

アップル

Apple Mac OS X v10.5.8

Apple Mac OS X v10.6 から v10.6.6

Apple Mac OS X Server v10.5.8

Apple Mac OS X Server v10.6 から v10.6.6

Ruby-lang.org

Ruby 1.9.2-p136 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2011-0188	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0188
National Vulnerability Database (NVD)
2	CVE-2011-0188	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0188

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-189	https://jvndb.jvn.jp/ja/cwe/CWE-189.html

ベンダー情報

No	Name	URL
Apple Security Updates
1	HT4581	http://support.apple.com/kb/HT4581
Apple セキュリティアップデート
2	HT4581	http://support.apple.com/kb/HT4581?viewlocale=ja_JP
Asianux Technical Support Network
3	ruby-1.8.5-19.1.0.1.AXS3	https://tsn.miraclelinux.com/tsn_local/index.php?m=errata&a=detail&eid=1463
MIRACLE LINUX アップデート情報
4	2225	https://www.miraclelinux.com/support/index.php?q=node/99&errata_id=2225
Red Hat Security Advisory
5	RHSA-2011:0910	https://rhn.redhat.com/errata/RHSA-2011-0910.html
Ruby
6	Ruby 1.9.2-p136リリース	http://www.ruby-lang.org/ja/news/2010/12/25/ruby-1-9-2-p136-is-released

その他

No	Name	URL
JVN
1	JVNVU#636925	http://jvn.jp/cert/JVNVU636925
Secunia Advisory
2	SA44638	http://secunia.com/advisories/44638
SecurityFocus
3	46966	http://www.securityfocus.com/bid/46966
SecurityTracker
4	1025236	http://www.securitytracker.com/id?1025236

Change Log

No	Changed Details	Date of change
0	[2011年04月25日] 掲載 [2011年06月30日] 影響を受けるシステム：レッドハット (RHSA-2011:0910) の情報を追加ベンダ情報：レッドハット (RHSA-2011:0910) を追加 [2011年07月28日] 影響を受けるシステム：ミラクル・リナックス (2225) の情報を追加影響を受けるシステム：ミラクル・リナックス (ruby-1.8.5-19.1.0.1.AXS3) の情報を追加ベンダ情報：ミラクル・リナックス (2225) を追加ベンダ情報：ミラクル・リナックス (ruby-1.8.5-19.1.0.1.AXS3) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2011-0188

Summary	The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue."
Publication Date	March 23, 2011, 11 a.m.
Registration Date	Jan. 28, 2021, 4:37 p.m.
Last Update	Nov. 21, 2024, 10:23 a.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:ruby-lang:ruby::::::::			1.9.2-p136
cpe:2.3:a:ruby-lang:ruby:1.9:r18423::::::
cpe:2.3:a:ruby-lang:ruby:1.9:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0:r18423::::::
cpe:2.3:a:ruby-lang:ruby:1.9.0-0:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0-1:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0-2:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0-20060415:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0-20070709:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc2::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_1::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_2::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p129::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p0::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p429::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc1::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p243::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p376::::::
cpe:2.3:a:ruby-lang:ruby:1.9.2:dev::::::
cpe:2.3:a:ruby-lang:ruby:1.9.2:::::::*
execution environment
1	cpe:2.3:o:apple:mac_os_x:10.5.8:::::::*
2	cpe:2.3:o:apple:mac_os_x:10.6.0:::::::*
3	cpe:2.3:o:apple:mac_os_x:10.6.1:::::::*
4	cpe:2.3:o:apple:mac_os_x:10.6.2:::::::*
5	cpe:2.3:o:apple:mac_os_x:10.6.3:::::::*
6	cpe:2.3:o:apple:mac_os_x:10.6.4:::::::*
7	cpe:2.3:o:apple:mac_os_x:10.6.5:::::::*
8	cpe:2.3:o:apple:mac_os_x:10.6.6:::::::*
9	cpe:2.3:o:apple:mac_os_x_server:10.5.8:::::::*
10	cpe:2.3:o:apple:mac_os_x_server:10.6.0:::::::*
11	cpe:2.3:o:apple:mac_os_x_server:10.6.1:::::::*
12	cpe:2.3:o:apple:mac_os_x_server:10.6.2:::::::*
13	cpe:2.3:o:apple:mac_os_x_server:10.6.3:::::::*
14	cpe:2.3:o:apple:mac_os_x_server:10.6.4:::::::*
15	cpe:2.3:o:apple:mac_os_x_server:10.6.5:::::::*
16	cpe:2.3:o:apple:mac_os_x_server:10.6.6:::::::*

Related information, measures and tools

No	URL	タグ
1	http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html	Patch Vendor Advisory
2	http://support.apple.com/kb/HT4581	Patch
3	http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993	Patch Vendor Advisory
4	http://www.mandriva.com/security/advisories?name=MDVSA-2011:097
5	http://www.mandriva.com/security/advisories?name=MDVSA-2011:098
6	http://www.redhat.com/support/errata/RHSA-2011-0908.html
7	http://www.redhat.com/support/errata/RHSA-2011-0909.html
8	http://www.redhat.com/support/errata/RHSA-2011-0910.html
9	http://www.securitytracker.com/id?1025236
10	https://bugzilla.redhat.com/show_bug.cgi?id=682332	Patch
11	http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html	Patch Vendor Advisory
12	https://bugzilla.redhat.com/show_bug.cgi?id=682332	Patch
13	http://www.securitytracker.com/id?1025236
14	http://www.redhat.com/support/errata/RHSA-2011-0910.html
15	http://www.redhat.com/support/errata/RHSA-2011-0909.html
16	http://www.redhat.com/support/errata/RHSA-2011-0908.html
17	http://www.mandriva.com/security/advisories?name=MDVSA-2011:098
18	http://www.mandriva.com/security/advisories?name=MDVSA-2011:097
19	http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993	Patch Vendor Advisory
20	http://support.apple.com/kb/HT4581	Patch

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-189	数値処理の問題	https://cwe.mitre.org/data/definitions/189.html

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:ruby-lang:ruby::::::::			1.9.2-p136
cpe:2.3:a:ruby-lang:ruby:1.9:r18423::::::
cpe:2.3:a:ruby-lang:ruby:1.9:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0:r18423::::::
cpe:2.3:a:ruby-lang:ruby:1.9.0-0:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0-1:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0-2:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0-20060415:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.0-20070709:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc2::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_1::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-preview_2::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p129::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p0::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p429::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-rc1::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:::::::*
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p243::::::
cpe:2.3:a:ruby-lang:ruby:1.9.1:-p376::::::
cpe:2.3:a:ruby-lang:ruby:1.9.2:dev::::::
cpe:2.3:a:ruby-lang:ruby:1.9.2:::::::*
execution environment
1	cpe:2.3:o:apple:mac_os_x:10.5.8:::::::*
2	cpe:2.3:o:apple:mac_os_x:10.6.0:::::::*
3	cpe:2.3:o:apple:mac_os_x:10.6.1:::::::*
4	cpe:2.3:o:apple:mac_os_x:10.6.2:::::::*
5	cpe:2.3:o:apple:mac_os_x:10.6.3:::::::*
6	cpe:2.3:o:apple:mac_os_x:10.6.4:::::::*
7	cpe:2.3:o:apple:mac_os_x:10.6.5:::::::*
8	cpe:2.3:o:apple:mac_os_x:10.6.6:::::::*
9	cpe:2.3:o:apple:mac_os_x_server:10.5.8:::::::*
10	cpe:2.3:o:apple:mac_os_x_server:10.6.0:::::::*
11	cpe:2.3:o:apple:mac_os_x_server:10.6.1:::::::*
12	cpe:2.3:o:apple:mac_os_x_server:10.6.2:::::::*
13	cpe:2.3:o:apple:mac_os_x_server:10.6.3:::::::*
14	cpe:2.3:o:apple:mac_os_x_server:10.6.4:::::::*
15	cpe:2.3:o:apple:mac_os_x_server:10.6.5:::::::*
16	cpe:2.3:o:apple:mac_os_x_server:10.6.6:::::::*