----------------------------------------------------------------------

A new version (0.9.0.0 - Release Candidate 1) of the free Secunia PSI
has been released. The new version includes many new and advanced
features, which makes it even easier to stay patched.

Download and test it today:
https://psi.secunia.com/

Read more about this new version:
https://psi.secunia.com/?page=changelog

----------------------------------------------------------------------

TITLE:
Ruby WEBrick Information Disclosure Vulnerabilities

SECUNIA ADVISORY ID:
SA29232

VERIFY ADVISORY:
http://secunia.com/advisories/29232/

CRITICAL:
Moderately critical

IMPACT:
Exposure of system information, Exposure of sensitive information

WHERE:
>From remote

SOFTWARE:
Ruby 1.8.x
http://secunia.com/product/3787/

DESCRIPTION:
Some vulnerabilities have been reported in Ruby, which can be
exploited by malicious people to disclose sensitive information.

1) Input passed via the URL to applications using
"WEBrick::HTTPServlet::FileHandler" or "WEBrick::HTTPServer.new" with
the ":DocumentRoot" option is not properly sanitised before being
used. This can be exploited to display arbitrary files via directory
traversal attacks of the form "..%5c..%5c".

Successful exploitation requires that the application is running on
an operating system accepting the backslash character as a path
separator (e.g. Windows).

2) The vulnerability is caused due to an error within the
"WEBrick::HTTPServlet::FileHandler" class, and within the
"WEBrick::HTTPServer.new" method when handling the
":NondisclosureName" option. This can be exploited to disclose the
content of arbitrary files with a filename matching the pattern
specified in the ":NondisclosureName" option.   

Successful exploitation requires that the application is running on
an operating system using a case insensitive filesystem (e.g. Windows
or Mac OS X).

The vulnerabilities are reported in versions prior to 1.8.4, 1.8.5
versions prior to 1.8.5-p115, 1.8.6 versions prior to 1.8.6-p114, and
1.9 versions prior to and including 1.9.0-1.

SOLUTION:
Update to 1.8.5-p115 or 1.8.6-p114, or apply the vendor patch for
version 1.9.0-1.
ftp://ftp.ruby-lang.org/pub/ruby/1.9/ruby-1.9.0-1-webrick-vulnerability-fix.diff

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Digital Security Research.

ORIGINAL ADVISORY:
http://www.ruby-lang.org/en/news/2008/03/03/webrick-file-access-vulnerability/

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------