[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5F0E9E9A-1F99-41F5-8936-2D4A5B9EF633@vmware.com>
Date: Wed, 16 Jul 2014 15:54:19 +0000
From: Ramon de C Valle <rdecvalle@...are.com>
To: Tomas Hoger <thoger@...hat.com>
CC: "cve-assign@...re.org" <cve-assign@...re.org>,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
"mmcallis@...hat.com" <mmcallis@...hat.com>
Subject: Re: [ruby-core:63604] [ruby-trunk - Bug #10019]
[Open] segmentation fault/buffer overrun in pack.c (encodes)
On Jul 16, 2014, at 12:16 PM, Tomas Hoger <thoger@...hat.com> wrote:
> On Tue, 15 Jul 2014 15:10:05 +0000 Ramon de C Valle wrote:
>
>>> First, we don't know what "The same sample works under 1.9.3" means.
>>> It might mean "The same AWS sample is also a working vulnerability
>>> reproducer when using Ruby 1.9.3." It might instead mean "With this
>>> AWS sample, my program works normally when using Ruby 1.9.3; in
>>> other words, no vulnerability is observed.”
>>
>> It meant that his sample worked normally when he used Ruby 1.9.3. (I
>> assumed this because the version he specified as containing the bug
>> in the report was Ruby 2.1, and specified Ruby 2.0 as requiring
>> backport, but not Ruby 1.9.3.)
>
> It's reasonable to assume that reporter did not touch the "Backport:"
> field at all. The issue was reported for ruby 2.1.2p168 (see the "ruby
> -v" field). Backport value was original set to:
>
> 2.0.0: UNKNOWN, 2.1: UNKNOWN
>
> which happens to be the default value pre-filed into the field for you
> by the bug tracker when you try create a new issue. You can easily
> check by visiting:
>
> https://urldefense.proofpoint.com/v1/url?u=https://bugs.ruby-lang.org/projects/ruby-trunk/issues/new&k=oIvRg1%2BdGAgOoM1BIlLLqw%3D%3D%0A&r=bZpuVimtRQUx3xHFIlu%2BaciWn3GMzM%2FBnwDoBm5jP8U%3D%0A&m=lvYqyGvlOo5QOKyQaxN7hxz4fIAGdWpnzcVczLGTTHE%3D%0A&s=9741b68b74eb44558252f0c9758238f5eb18199838d2f3821f2214c00241ff20
>
> All changes from UNKNOWN to REQUIRED were not done by the reporter, as
> you can see from the bug comments.
>
> I don't think you can draw the conclusion based on the Backport field.
Yes, you’re right. I didn’t notice that. So, it’s still unclear what the author meant with that statement (i.e., Ruby 1.9.3 may also be affected if there exists another issue).
>
> --
> Tomas Hoger / Red Hat Security Response Team
--
Ramon de C Valle
VMware Product Security Engineering
Download attachment "signature.asc" of type "application/pgp-signature" (843 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
