ruby-ffi up to 1.9.23 on Windows DLL Loader untrusted search path

Summaryinfo

A vulnerability was found in ruby-ffi up to 1.9.23 on Windows. It has been rated as critical. This issue affects some unknown processing of the component DLL Loader. Performing a manipulation results in untrusted search path. This vulnerability is known as CVE-2018-1000201. Attacking locally is a requirement. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in ruby-ffi up to 1.9.23 on Windows (Programming Language Software). It has been classified as critical. This affects an unknown function of the component DLL Loader. The manipulation with an unknown input leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.

The bug was discovered 06/01/2018. The weakness was published 06/22/2018 (GitHub Repository). The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2018-1000201 since 06/05/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1574 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 21 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 1.9.24 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Programming Language Software

Name

• ruby-ffi

Version

• 1.9.0
• 1.9.1
• 1.9.2
• 1.9.3
• 1.9.4
• 1.9.5
• 1.9.6
• 1.9.7
• 1.9.8
• 1.9.9
• 1.9.10
• 1.9.11
• 1.9.12
• 1.9.13
• 1.9.14
• 1.9.15
• 1.9.16
• 1.9.17
• 1.9.18
• 1.9.19
• 1.9.20
• 1.9.21
• 1.9.22
• 1.9.23

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion