From: "Randy W. Sims" <ml-ruby@...>
Date: 2006-06-01T15:50:46+09:00
Subject: Re: Ruby security question

Jeff Pritchard wrote:
> I work for a fortune 100 company in the telecom space.  They are 
> absolutely dirtying their shorts over security concerns.  They haven't 
> had any major fallout yet, but they figure it's inevitable.  They have 
> been flying in experts to tell us all how to write safer C code.
> 
> Having witnessed several such 1 to 3 day tirades on how to write safer C 
> code, I think I can summate 99% of the issue as:
> "make sure you don't over-run any buffers".  This is because almost all 
> of the "exploits" that don't involve walking in through an open door 
> involve pushing executable code into an over-written buffer.
> 
> I've been thinking it over, and I can't for the life of me think of a 
> way to over-run a buffer in Ruby.
> 
> Is this the same as thinking one is safe from viruses because he's 
> driving a Macintosh, or is Ruby (and any other ducktyped and garbage 
> collected, etc. etc. language) automatically much safer by default?

I know of specific examples of some interpreted languages experiencing 
the same type of buffer overruns. Generally they involved thin wrappers 
around unsafe C-level functions, generally the string formatting 
functions. I don't know if Ruby specifically suffers from any, but the 
same potential exists in most interpreted languages that I know of.

You can guard against it in your code the same way you would in C. Check 
any arguments that come from outside your program control and that are 
passed into any unsafe C-level functions (those involving varargs, etc, 
eg. printf-family of functions). Same for exec/forking, etc.

Randy.