ruby-dev

　やまねと申します。

　どなたか、以下のWEBrickに関するセキュリティ修正をご存知の方はいらっしゃい
　ますか？

　http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0541

　Apple のアドバイザリは以下で

>Ruby
>CVE-ID:  CVE-2010-0541
>Available for:  Mac OS X v10.5.8, Mac OS X Server v10.5.8,
>Mac OS X v10.6 through v10.6.3, Mac OS X Server v10.6 through v10.6.3
>Impact:  A remote attacker may gain access to accounts served by Ruby
>WEBrick
>Description:  A cross-site scripting issue exists in the Ruby WEBrick
>HTTP server's handling of error pages. Accessing a maliciously
>crafted URL in certain web browsers may cause the error page to be
>treated as UTF-7, allowing JavaScript injection. The issue is
>addressed by setting UTF-8 as the default character set in HTTP error
>responses. Credit: Apple.

　ざっと検索してみたところRed Hatのbugzillaにそのパッチというのが出ています。
　https://bugzilla.redhat.com/show_bug.cgi?id=587731

--- lib/webrick/httpresponse.rb.old        2010-03-31 18:47:40.000000000 -0700
+++ lib/webrick/httpresponse.rb        2010-03-31 18:48:21.000000000 -0700
@@ -209,7 +209,7 @@
        @keep_alive = false
        self.status = HTTPStatus::RC_INTERNAL_SERVER_ERROR
      end
-      @header['content-type'] = "text/html"
+      @header['content-type'] = "text/html; charset=utf-8"

      if respond_to?(:create_error_page)
        create_error_page()


　snapshotのアーカイブを展開してみましたが上記の変更は加えられてないので、
　そもそもruby本体に修正の話が来ていないんじゃないかと思ってメールしてみました。
　これで修正内容が十分なのか、わかる方がいらっしゃったらぜひ確認してみていただけ
　ると嬉しいです :)


-- 
Regards,

 Hideki Yamane     henrich @ debian.or.jp/org
 http://wiki.debian.org/HidekiYamane

Thread

Prev Next

In This Thread

Prev Next

[#41911] [Bug #3644] thread_win32.c / native_stop_timer_thread() がタイマースレッドの終了を待たずに帰ってきてしまう。 — 権兵衛 名無し <redmine@...>

[#41918] [Feature #3647] Array#sample(n, replace=false) — Kenta Murata <redmine@...>

[#41923] [Feature #3649] Array#sample, Array#shuffle, Array#shuffle! で使用する乱数生成器を指定するためにオプショナル引数を追加する — Kenta Murata <redmine@...>

[#41924] [Bug #3650] NEWSの不整合 — Kazuhiro NISHIYAMA <redmine@...>

[#41925] Ruby committers Q&A at RubyKaigi — Shugo Maeda <shugo@...>

[#41927] Release engineering status of 1.9.2-p0 — Yusuke ENDOH <mame@...>

[#41931] [Bug #3657] make cleanがファイルを削除しすぎ — Takahiro Kambe <redmine@...>

[#41933] *array で異常終了 — 小田 利通 <oda@...>

[#41936] [Bug #3659] Marshal.load(Marshal.dump(10.0)) => 1.0 — Tomoyuki Chikanaga <redmine@...>

[#41953] [bug:trunk] call File.lchmod via rb_funcall [BUG] vm_call0: unsupported method type (7) — Tanaka Akira <akr@...>

[#41956] [Bug #3468][Closed] .cvsignore — Nobuyoshi Nakada <redmine@...>

[#41957] 1.9.2でtest_require_too_long_filename(TestRequire)がFailureになる — kimura wataru <kimuraw@...>

[#41962] Re: [ruby-cvs:36129] Ruby:r28927 (ruby_1_9_2): merges r28835 from trunk into ruby_1_9_2. — Masaki Suketa <masaki.suketa@...>

[#41965] [Bug #3672] PTY.getpty with non exist program — Yui NARUSE <redmine@...>

[#41966] [Bug #3673] PTY.getpty with IO.pipe doesn't finish on FreeBSD — Yui NARUSE <redmine@...>

[#41967] [Bug #3674] dRuby サーバプロセスを停止する時に時間がかかることがある — Tomoyuki Chikanaga <redmine@...>

[#41969] [Feature #3675] String#prepend, String#>> — Sora Harakami <redmine@...>

[#41970] test/unit.rb:44: warning: instance variable @init_hook not initialized — Tanaka Akira <akr@...>

[#41971] Re: [ruby-cvs:36152] Ruby:r28950 (trunk): [ruby-core:31658] — "NARUSE, Yui" <naruse@...>

[#41972] [Bug #3676] CMath.cbrt(-8)の結果が複素数にならない — tadayoshi funaba <redmine@...>

[#41974] Re: [ruby-cvs:36157] Ruby:r28955 (trunk): * complex.c (nucomp_to_[ifr]): don't allow complex with in-exact — Yukihiro Matsumoto <matz@...>

[#41995] Re: [ruby-core:31672] [Bug #3678] CMath.sqrt(1.i) results to 0.0+0.0i — Urabe Shyouhei <shyouhei@...>

[#42003] WEBrickに関するセキュリティ修正 (CVE-2010-0541) — Hideki Yamane <henrich@...>

[#42022] [Bug #3693] visibility hidden functions — Narihiro Nakamura <redmine@...>

[#42031] [Bug #3695] r28978 fails to make all — Shyouhei Urabe <redmine@...>

[#42038] [Bug: trunk] Fwd: [ruby-list:47272] case when 整数と実数の比較 (ruby 1.9) — SASADA Koichi <ko1@...>

[#42040] [Bug #3674] dRuby サーバプロセスを停止する時に時間がかかることがある — Tomoyuki Chikanaga <redmine@...>

[#42042] GC::profiler.report for large memory. — Tomoaki NISHIYAMA <tomoakin@...>

[#42050] [Bug #3703] ChangeLog too big. — Shyouhei Urabe <redmine@...>

[#42057] rdf generated by rss library is not valid — Tanaka Akira <akr@...>

[#42058] redmine.ruby-lang.orgのproject数を減らせないか？ — "NAKAMURA, Hiroshi" <nakahiro@...>

[#42063] [Bug #3706] dependency from version.o to version.h — Yuki Sonoda <redmine@...>

[#42067] [Bug #3708] Array#permutation がおかしな結果を返す — Shumpei Akai <redmine@...>

[#42070] [Bug #3708][Closed] Array#permutation がおかしな結果を返す — Kenta Murata <redmine@...>

[#42071] [Bug #3708][Open] Array#permutation がおかしな結果を返す — Kenta Murata <redmine@...>

[#42077] [Bug #3708][Closed] Array#permutation がおかしな結果を返す — Kenta Murata <redmine@...>

[#42078] [Backport #3708][Assigned] Array#permutation がおかしな結果を返す — Kenta Murata <redmine@...>

[#42079] Re: [ruby-cvs:36248] Ruby:r29048 (trunk): * backport r28621 and r28632 from ruby_1_8; — "NARUSE, Yui" <naruse@...>

[#42083] [Bug #3720] test_marshal_dump_extra_iv doesn't check as intended — Tomoyuki Chikanaga <redmine@...>

[#42086] valgrind and test/ruby/test_regexp.rb — Tanaka Akira <akr@...>

[#42089] [Bug #3733] $SAFE==1環境下でtaintな文字列のFile.expand_path — Tadashi TADA <redmine@...>

[#42090] Math::atan2(0, 0) on ruby 1.9.2 — KUBO Takehiro <kubo@...>

[#42093] version.hのRUBY_VERSION_TEENYが古いのでは？ — Moru <lateau@...>

[#42100] make distclean時エラーメッセージ — Moru <lateau@...>

[#42102] DevelopersMeeting20100827 — SASADA Koichi <ko1@...>

[#42105] [Bug #3734] Float('0xf.fp') がエラーにならない — tadayoshi funaba <redmine@...>

[#42111] [Bug #3459][Closed] test_regexp.rb Segmentation fault on x64-mswin64 — Yui NARUSE <redmine@...>

[#42116] [Bug #3736] Complex#argがエラーになることがある — tadayoshi funaba <redmine@...>

[#42125] vc9 x64でtrunk dlがコンパイルできない — kuwamoto shintaro <beuniv@...>

[#42133] [Bug #3742] failed to allocate memory: /^()(?>\g<1>)*$/ on x64-mswin64 — shintaro kuwamoto <redmine@...>

[#42148] Rubygems on Ruby 1.9.2 and yaml. — Takahiro Kambe <taca@...>

[#42150] [Bug #3734][Closed] Float('0xf.fp') がエラーにならない — Yui NARUSE <redmine@...>

[#42151] [Feature #3753] value of def-expr — Usaku NAKAMURA <redmine@...>

[#42154] [Ruby 1.9-Bug#3759][Open] make rdocで不要と思われるファイル"rdoc/Set/dig = {}/cdesc-dig = {}.ri"が生成される — Wataru Kimura <redmine@...>

[#42155] Math モジュールの互換性(was: Math::atan2(0, 0) on ruby 1.9.2) — KUBO Takehiro <kubo@...>

[#42156] [Ruby 1.9-Bug#3759][Closed] make rdocで不要と思われるファイル"rdoc/Set/dig = {}/cdesc-dig = {}.ri"が生成される — Nobuyoshi Nakada <redmine@...>

[#42158] [Ruby-Bug#3770][Open] ruby test/dl/test_callback.rbでBus Error — Shota Fukumori <redmine@...>

[#42159] [Ruby 1.9-Bug#3771][Open] VC++ can't make ext/tk with enabling stubs — Akio Tajima <redmine@...>

[#42162] Bug #3722 に関するご報告 — Satoshi Shiba <shiba@...>

[#42164] [Ruby 1.9-Bug#3774][Rejected] irbで日本語が入力できない — Yui NARUSE <redmine@...>

[#42165] [Ruby 1.9-Bug#3774] irbで日本語が入力できない — Takeyuki Fujioka <redmine@...>

[#42166] Ruby'sライセンスの、BSDLとのデュアルライセンスへの変更 — "NARUSE, Yui" <naruse@...>

[ruby-dev:42003] WEBrickに関するセキュリティ修正 (CVE-2010-0541)

Thread

In This Thread

[#41911] [Bug #3644] thread_win32.c / native_stop_timer_thread() がタイマースレッドの終了を待たずに帰ってきてしまう。 — 権兵衛名無し <redmine@...>

[#41933] *array で異常終了 — 小田利通 <oda@...>