Description
The XMLRPC server in utils.rb for the ruby library (libruby) 1.8 sets an invalid default value that prevents "security protection" using handlers, which allows remote attackers to execute arbitrary commands.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | ruby1.8 | 1.8.2-7sarge1 | DSA-748-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | irb +6 | 1.8.1-7.EL4.1 | RHSA-2005:543 |
Advisories 2
- RHSA-2005:543 Red Hat Security Advisory: ruby security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-748-1 ruby1.8 - bad default value Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-748 vendor-advisory
- SUSE-SR:2005:018 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=315064
- VU#684913 third-party-advisory
- RHSA-2005:543 vendor-advisory
- P-312 third-party-advisory government-resource
- 14016 vdb-entry
- oval:org.mitre.oval:def:10819 vdb-entry signature
- http://www2.ruby-lang.org/en/20050701.html
- http://blade.nagaokaut.ac.jp/cgi-bin/scat.rb/ruby/ruby-core/5237
- ESB-2005.0732 third-party-advisory
- APPLE-SA-2005-09-22 vendor-advisory
- 16920 third-party-advisory