A vulnerability was found in Ruby 1.9.3 (Programming Language Software). It has been classified as critical. Affected is an unknown code in the library wlbsctrl.dll of the component Installation. The manipulation with an unknown input leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Ruby193\bin directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the Ruby installation

The weakness was disclosed 10/11/2012 (Website). The advisory is available at htbridge.com. This vulnerability is traded as CVE-2012-5380 since 10/11/2012. The exploitability is told to be difficult. Local access is required to approach this attack. A authentication is needed for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1574 by the MITRE ATT&CK project.

The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-62685, VDB-62684, VDB-62683 and VDB-62681 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Language Software

Name

• Ruby

Version

• 1.9.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion