Posted by Shugo Maeda on 1 Jul 2005
On Fri Jun 17 2005, a vulnerability of XMLRPC.iPIMethods was reported in [ruby-core:05237]. Remote attackers can execute arbitrary commands by this vulnerability.
Affected Programs
Programs providing XML-RPC services by XMLRPC.iPIMethods are affected.
Fix
This vulnerability was already fixed in both the CVS HEAD and the ruby_1_8 branch.
Please apply this patch for ruby-1.8.2.
- www.ruby-lang.org/patches/ruby-1.8.2-xmlrpc-ipimethods-fix.diff
--- ruby-1.8.2/lib/xmlrpc/utils.rb.orig 2003-08-15 02:20:14.000000000 +0900
+++ ruby-1.8.2/lib/xmlrpc/utils.rb 2005-07-01 16:33:19.243521736 +0900
@@ -138,7 +138,7 @@
def get_methods(obj, delim=".")
prefix = @prefix + delim
- obj.class.public_instance_methods.collect { |name|
+ obj.class.public_instance_methods(false).collect { |name|
[prefix + name, obj.method(name).to_proc, nil, nil]
}
end