Ruby/Gnome2 0.16.0 Format String Vulnerability Nov 27 2007 12:16PM
chris rohlf gmail com
RubyGnome2 0.16.0

Format String Vulnerability In Gtk::MessageDialog

Ruby Gnome2 is a project to provide GTK2 bindings to ruby scripts so you can write GUI code in less time. There is a format string vulnerability in Gtk::MessageDialog(). This design flaw does not

allow for a user generated string to be safely sent to this function.

It is really just an API to the GTK2 function gtk_message_dialog_new() Ruby/Gnome2 does not properly use a format specifier for the message

variable in ruby-gnome2-all-0.16.0/gtk/src/rbgtkmessagedialog.c as requested by the Gtk man page for this function.


w = gtk_message_dialog_new(NIL_P(parent) ? NULL : GTK_WINDOW(RVAL2GOBJ(parent)),




(const gchar*)(NIL_P(message) ? "": RVAL2CSTR(message)));


The GTK2 documentation:

states that message should be a 'printf style format string' and after that should be arguments to message. However calling messagedialog from your ruby script does not support this.

The vulnerability can be exploited by sending a specially crafted string to the function. An example ruby program is provided as a POC.


#!/usr/bin/env ruby

# ruby rubber.rb %x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x

require 'libglade2'

my_string = ARGV[0]

dialog =, Gtk::Dialog::MODAL,



"%s - Was your string!" % my_string)



A temporary work around for this vulnerability is using the markup member:

dialog.markup = "#{my_string} - Was your string!"


my_string = "my_string = my_string.gsub(/%/, "%%")

I have found a few ruby/gnome2 apps out there who use the API in this unsafe manner.

Fixed Nov 27th 2007 in Ruby/Gnome2 SVN

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus