From: Urabe Shyouhei <shyouhei@...>
Date: 2010-01-10T18:41:08+09:00
Subject: [Security] WEBrick has an Escape Sequence Injection vulnerability

--------------enig4B72665CB8AB5BEE9F5EFA6D
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

WEBrick has an Escape Sequence Injection vulnerability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D

Synopsis
--------

A vulnerability was found on WEBrick, a part of Ruby's standard library.
WEBrick lets attackers to inject malicious escape sequences to its logs, =
making
it possible for dangerous control characters to be executed on a victim's=

terminal emulator.

We already have a fix for it.  Releases for every active branches are to =
follow
this announce. But for a meantime, we recommend you to avoid looking at y=
our
WEBrick logs, until you update your WEBrick process.

Detailed description
--------------------

Terminal escape sequences are used to allow various forms of interaction
between a terminal and a inside process.  The problem is that those seque=
nces
are not intended to be issued by untrusted sources; such as network input=
s. So
if a remote attacker could inject escape sequences into WEBrick logs, and=
 a
victim happen to consult them through his/her terminal, the attacker coul=
d take
advantages of various weaknesses in terminal emulators[1].

And WEBrick fails to filter those terminal escape sequences.

Example:

    % xterm -e ruby -rwebrick -e 'WEBrick::HTTPServer.new(:Port=3D>8080).=
start' &
    % wget http://localhost:8080/%1b%5d%32%3b%6f%77%6e%65%64%07%0a


Watch out for the window title of xterm.

Affected versions
-----------------

* Ruby 1.8.6 patchlevel 383 and all prior versions
* Ruby 1.8.7 patchlevel 248 and all prior versions
* Development versions of Ruby 1.8 (1.8.8dev)
* Ruby 1.9.1 patchlevel 376 and all prior versions
* Development versions of Ruby 1.9 (1.9.2dev)

Solutions
---------

* Fixes for 1.8.6, 1.8.7, and 1.9.1 are to follow this announce.
* For development versions, please update to the most recent revision for=
 each
development branch.

Credit
------

Credit to Giovanni "evilaliv3" Pellerano, Alessandro "jekil" Tanasi, and
Francesco "ascii" Ongaro for discovering this vulnerability.


[1] http://marc.info/?l=3Dbugtraq&m=3D104612710031920&w=3D2
    "Terminal Emulator Security Issues"



--------------enig4B72665CB8AB5BEE9F5EFA6D
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAktJoKIACgkQuTXPUnA5eMJoYwCfQ715zoNai4TYvA6vRmKGoYc3
3k8Anj6cc74UczwtpAFb8jh+g/II0YNK
=b4ni
-----END PGP SIGNATURE-----

--------------enig4B72665CB8AB5BEE9F5EFA6D--