[ruby-dev:27254] Re: 脆弱性レポート翻訳者募集

zundaと申します

--- Yukihiro Matsumoto <[e-mail]> からのメッセージ：
> まつもと ゆきひろです
> 
> 1.8.2以前のRubyには脆弱性があります。これがリリースを急いだ
> 理由だったりするんですが、このレポートの英訳を手伝ってくださ
> る方はいらっしゃいませんか。

とりあえずの叩き台として拙訳をお送りしておきます。jvnのURLは
#をエンコードしておく必要があるように思います。

---
Ruby allows bypassing the safe level settings


Date published: 2005-09-21


Versions affected:

  Stable releases(1.8.x) - Versions 1.8.2 and earlier
                           (fixed on Version 1.8.3)
  Old rleases(1.6.x) - Versions 1.6.8 and earlier
  Development versions(1.9.0) - Versions 2005-09-01 and earlier
                                (fixed on Version 2005-09-02)

Summary:

  Ruby versions listed above have a vulnerability that allows an arbitrary
  code to run bypassing the safe level check.

Solution:

  Users of stable releases (1.8.x) and development versions (1.9.0) should
  update Ruby to the latest versions that are listed above.

  Users of old releases (1.6.x) should update to the stable releases (1.8.x)
  or download the latest snapshot for 1.6.x from the URL below, build, and
  install.

  ftp://ftp.ruby-lang.org/pub/ruby/snapshot-1.6.tar.gz

  A patch from ruby-1.6.8.tar.gz is also provided at the following location:

  ftp://ftp.ruby-lang.org/pub/ruby/1.6/1.6.8-patch1.gz
  md5sum: 7a97381d61576e68aec94d60bc4cbbab

Description:

  The Object Oriented Scripting Language Ruby supports safely executing an
  untrusted code with two mechanisms: safe level and taint flag on objects.

  A vulnerability is found that allows bypassing these mechanisms.

  By using the vulnerability, an arbitrary code can be executed beyond the
  restrictions specified in each safe level. Therefore, Ruby has to be
  updated on all systems that use safe level to execute untrusted codes.

Reference:

  JVN: JVN#98965847 <URL:http://jvn.jp/jp/JVN%2398965847/index.html>
  (in Japanese)

Acknowledgment:

  We thank Dr. Yutaka Oiwa, Research Center for Information Security,
  National Institute of Advanced Industrial Science and Technology, who
  found the vulnerability that allows bypassing safe level.



__________________________________
 For All Sports Fans!
 http://pr.mail.yahoo.co.jp/yells/