Ruby is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely cause a denial-of-service condition.
Ruby versions 2.2.2, and 2.3.0 are vulnerable.
Information
Yukihiro Matsumoto Ruby 2.2.2
Ubuntu Ubuntu Linux 17.04
Ubuntu Ubuntu Linux 16.04 LTS
Ubuntu Ubuntu Linux 14.04 LTS
Exploit
The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.
References:
- Ruby Home Page (Yukihiro Matsumoto)
- TALOS-2016-0031: Ruby TclTkIp ip_cancel_eval Type Confusion Vulnerabilities (Cisco)