From: Yusuke Endoh Date: 2010-06-06T22:07:13+09:00 Subject: [ruby-core:30618] [Bug #1800][Assigned] rubygems can replace system executable files Issue #1800 has been updated by Yusuke Endoh. Status changed from Open to Assigned Priority changed from Urgent to Normal Target version changed from 1.9.2 to 1.9.x Hi, I realized more serious concern; "sudo gem install" executes extconf.rb with root access, which enables code execution by "an attacker". I think this does not means any security issue, but means a simple fact that rubygems assumes a user does not install untrusted gems. It is better to have an option to prompt before rewriting a file or executing extconf.rb. So I move this ticket to 1.9.x feature. -- Yusuke Endoh ---------------------------------------- http://redmine.ruby-lang.org/issues/show/1800 ---------------------------------------- http://redmine.ruby-lang.org