|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
If you have found a vulnerability, please send to our SecurityAlert Database : secalert()securityreason()com
Also if you have new ( 0-day ) exploit, please send to our ExploitAlert Archive :
exploit()securityreason()com |
|
|
Home SecurityAlert Database |
|
|
Topic : | Ruby/Gnome2 0.16.0 Format String Vulnerability
|
SecurityAlert : 3407
CVE : CVE-2007-6183
SecurityRisk : Medium (About)
Remote Exploit : Yes
Local Exploit : Yes
Exploit Available : Yes
Credit : chris rohlf
Published : 30.11.2007
Affected Software : | Ruby Gnome2, 0.16.0 |
 Advisory Content : RubyGnome2 0.16.0
Format String Vulnerability In Gtk::MessageDialog
http://em386.blogspot.com
Ruby Gnome2 is a project to provide GTK2 bindings to ruby scripts so you
can write GUI code in less time. There is a format string vulnerability in
Gtk::MessageDialog(). This design flaw does not
allow for a user generated string to be safely sent to this function.
It is really just an API to the GTK2 function gtk_message_dialog_new()
Ruby/Gnome2 does not properly use a format specifier for the message
variable in ruby-gnome2-all-0.16.0/gtk/src/rbgtkmessagedialog.c as
requested by the Gtk man page for this function.
...
w = gtk_message_dialog_new(NIL_P(parent) ? NULL :
GTK_WINDOW(RVAL2GOBJ(parent)),
RVAL2GFLAGS(flags, GTK_TYPE_DIALOG_FLAGS),
RVAL2GENUM(type, GTK_TYPE_MESSAGE_TYPE),
RVAL2GENUM(buttons, GTK_TYPE_BUTTONS_TYPE),
(const gchar*)(NIL_P(message) ? "": RVAL2CSTR(message)));
...
The GTK2 documentation:
http://www.gtk.org/api/2.6/gtk/GtkMessageDialog.html#gtk-message-dialog-
new
states that message should be a 'printf style format string' and after that
should be arguments to message. However calling messagedialog from your
ruby script does not support this.
The vulnerability can be exploited by sending a specially crafted string to
the function. An example ruby program is provided as a POC.
...
#!/usr/bin/env ruby
# ruby rubber.rb %x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x
require 'libglade2'
my_string = ARGV[0]
dialog = Gtk::MessageDialog.new(@main_app_window, Gtk::Dialog::MODAL,
Gtk::MessageDialog::INFO,
Gtk::MessageDialog::BUTTONS_CLOSE,
"%s - Was your string!" % my_string)
dialog.run
dialog.destroy
...
A temporary work around for this vulnerability is using the markup member:
dialog.markup = "#{my_string} - Was your string!"
Or
my_string = "my_string = my_string.gsub(/%/, "%%")
I have found a few ruby/gnome2 apps out there who use the API in this
unsafe manner.
Fixed Nov 27th 2007 in Ruby/Gnome2 SVN
Feedback :
If you have additional information or notice any errors regarding this security advisory, please use contact form or email us at info()securityreason()com.
|
|
|
|