• info
• discussion
• exploit
• solution
• references

Yukihiro Matsumoto Ruby XMLRPC Server Unspecified Command Execution Vulnerability

Solution:
Please see the referenced advisories for more information.


Yukihiro Matsumoto Ruby 1.8.2

• Debian libdbm-ruby1.8_1.8.2-7sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/r/ruby1.8/libdbm-ruby1.8_ 1.8.2-7sarge1_amd64.deb


• Debian libgdbm-ruby1.8_1.8.2-7sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/r/ruby1.8/libgdbm-ruby1.8 _1.8.2-7sarge1_amd64.deb


• Debian libopenssl-ruby1.8_1.8.2-7sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/r/ruby1.8/libopenssl-ruby 1.8_1.8.2-7sarge1_amd64.deb


• Debian libreadline-ruby1.8_1.8.2-7sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/r/ruby1.8/libreadline-rub y1.8_1.8.2-7sarge1_amd64.deb


• Debian libruby1.8-dbg_1.8.2-7sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/r/ruby1.8/libruby1.8-dbg_ 1.8.2-7sarge1_amd64.deb


• Debian libruby1.8_1.8.2-7sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/r/ruby1.8/libruby1.8_1.8. 2-7sarge1_amd64.deb


• Debian libtcltk-ruby1.8_1.8.2-7sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/r/ruby1.8/libtcltk-ruby1. 8_1.8.2-7sarge1_amd64.deb


• Debian ruby1.8-dev_1.8.2-7sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/r/ruby1.8/ruby1.8-dev_1.8 .2-7sarge1_amd64.deb


• Debian ruby1.8_1.8.2-7sarge1_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/r/ruby1.8/ruby1.8_1.8.2-7 sarge1_amd64.deb


• Yukihiro Matsumoto ruby-1.8.2-xmlrpc-ipimethods-fix.diff
  http://www.ruby-lang.org/patches/ruby-1.8.2-xmlrpc-ipimethods-fix.diff

Turbolinux Turbolinux Server 10.0

• TurboLinux ruby-1.8.1-6.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/10/up dates/RPMS/ruby-1.8.1-6.i586.rpm