From: Igal Koshevoy <igal@...>
Date: 2008-06-23T21:23:01+09:00
Subject: Re: Ruby 1.9.0/1.8.7/1.8.6/1.8.5 new releases (Security Fix)

Stanislav Sedov wrote:
> All the relevant changes were in array.cand string.c sources, I've backported both.
According to 
http://www.freebsd.org/cgi/cvsweb.cgi/ports/lang/ruby18/files/ you only 
patched sprintf.c and string.c but not array.c, which was specifically 
mentioned in the changelog as having a vulnerability. Furthermore, Zed 
Shaw mentioned many other files that seemed affected by security fixes 
at http://www.zedshaw.com/rants/the_big_ruby_vulnerabilities.html

> Can you prove that the port is still vulnerable?
No, I only know C well enough to tell that your patch didn't seem to 
match up with what was described elsewhere.

> It's better to look at the text fields before pressing
> the button and claiming it doesn't work - isn't it?
I did. The text fields read "1.1" and "1.2". These fields are wrong, the 
first should be something like "1.0" or "initial", and the second should 
be "1.1". Setting the first field to "1.0" fails because this is a 
forbidden field in your version control system, and version "1.2" 
doesn't exist. I see no way to get a diff by clicking the "Get diffs" 
button, therefore it doesn't work. Either don't show the button for 
newly imported files, or provide sensible behavior, like displaying the 
initial version so that the user doesn't get confused.

-igal
-- 
Posted via http://www.ruby-forum.com/.