CVE-2007-0469

描述

The `extract_files` function in `installer.rb` in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages.

如何修補 CVE-2007-0469

要修補 CVE-2007-0469,請將受影響套件升級到下列已修補版本。

• RubyGems/rubygems-update—升級至 0.9.1 或更新版本

CVE-2007-0469 正在被利用嗎?

低 — EPSS 為 4.8%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 0.9.1

參考連結(7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2007-0469
• PATCHgithub.com/rubygems/rubygems
• WEBmarc.info/?l=full-disclosure&m=116939816621060&w=2
• WEBwww.novell.com/linux/security/advisories/2007_4_sr.html
• WEB