Ruby String#unpack Method Information Disclosure Vulnerability [CVE-2018-8778]
CVE Number – CVE-2018-8778
A vulnerability in the String#unpack method provided by the String class in Ruby could allow an unauthenticated, remote attacker to access sensitive information on an affected system.
The vulnerability exists because the affected method improperly handles the “@” format specifier when used in an argument, which could cause a large number with the “@” specifier to be treated as a negative value and an out-of-buffer read. An attacker could exploit this vulnerability by sending a request that submits malicious input to the affected software. A successful exploit could allow the attacker to access sensitive information, which could be used to conduct additional attacks.
Ruby has confirmed the vulnerability and released software updates.
-
To exploit this vulnerability, the attacker must send a malicious request to the targeted system, making exploitation more difficult in environments that restrict network access from untrusted sources.
-
Administrators are advised to apply the appropriate updates.
Administrators are advised to allow only trusted users to have network access.
Administrators may consider using IP-based access control lists (ACLs) to allow only trusted systems to access the affected systems.
Administrators are advised to monitor affected systems.
-
Ruby has confirmed the vulnerability at the following link: CVE-2018-8778
-
Ruby has released software updates at the following link: Download Ruby
Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.