From: Urabe Shyouhei <shyouhei@...>
Date: 2008-03-12T07:36:54+09:00
Subject: Re: Webrick directory traversal exploit on UNIX

Hi,

Jos Backus wrote:
> /etc/passwd is shown (=bad). This means that e.g. ruby-1.8.5-p115 is still
> vulnerable on UNIX.
>   


First of all, thank you very much for reporting this.  We will fix this 
issue as soon as possible.

But your posting this sensitive info on a public mailing list cased a 
bit worrying situation where all existing WEBrick servers
are now facing a threat of attacks.  Next time would you please send us 
security considerations for security@ruby-lang.org?

To people running WEBrick servers:  we are now analyzing this issue.  
This is my personal opinion but it is safer for you to stop your 
processes (if possible) until we fix this.  Please stay tuned for 
upcoming announces.