This post originated from an RSS feed registered with Ruby Buzz by Eric Hodel. Original Post: RubyGems 0.9.0 and earlier installation exploit Feed Title: Segment7 Feed URL: http://blog.segment7.net/articles.rss Feed Description: Posts about and around Ruby, MetaRuby, ruby2c, ZenTest and work at The Robot Co-op. Latest Ruby Buzz Posts Latest Ruby Buzz Posts by Eric Hodel Latest Posts From Segment7

Problem Description:

RubyGems does not check installation paths for gems before writing files.

Impact:

Since RubyGems packages are typically installed using root permissions, arbitrary files may be overwritten on-disk. This may lead to denial of service, privilege escalation or remote compromise.

Workaround:

No known workarounds

Solution:

1. Upgrade to RubyGems 0.9.1

2. Apply one of the following patches:

   • For RubyGems 0.9.0:

     installer.rb.extract_files.REL_0_9_0.patch
     MD5 (installer.rb.extract_files.REL_0_9_0.patch) = bed4fcdd438a7d8b81cf72e1ffe48a7d 

   • For RubyGems 0.8.11:

     installer.rb.extract_files.REL_0_8_11.patch
     MD5 (installer.rb.extract_files.REL_0_8_11.patch) = 31e3bacd1821de0272864c153b7c0dca



Note:

Remote installations via Rubyforge will be disabled in the near future for versions of RubyGems earlier than 0.9.1, even for patched versions of RubyGems. Local installations will continue to work, however.

Thanks to Gavin Sinclair for finding and reporting this problem.

Testing your updated RubyGems:

Installing rspec-0.7.5 will give an InstallError on a patched version of RubyGems:

$ gem install rspec --version 0.7.5
ERROR:  While executing gem ... (Gem::InstallError)
    attempt to install file into "../web_spec/web_test_html_formatter.rb"

An updated rspec (0.7.5.1) has already been released.