Ruby 1.9.3 Installation wlbsctrl.dll untrusted search path ⚔ [Disputed]

Summaryinfo

A vulnerability was found in Ruby 1.9.3 and classified as problematic. This issue affects some unknown processing in the library wlbsctrl.dll of the component Installation. The manipulation results in untrusted search path. This vulnerability is reported as CVE-2012-5380. Moreover, an exploit is present. There are still doubts about whether this vulnerability truly exists.

Detailsinfo

A vulnerability was found in Ruby 1.9.3 (Programming Language Software). It has been classified as critical. Affected is an unknown code in the library wlbsctrl.dll of the component Installation. The manipulation with an unknown input leads to a untrusted search path vulnerability. CWE is classifying the issue as CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Ruby193\bin directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the Ruby installation

The weakness was disclosed 10/11/2012 (Website). The advisory is available at htbridge.com. This vulnerability is traded as CVE-2012-5380 since 10/11/2012. The exploitability is told to be difficult. Local access is required to approach this attack. A authentication is needed for exploitation. Technical details and a public exploit are known. This vulnerability is assigned to T1574 by the MITRE ATT&CK project.

The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (28130). The entries VDB-62685, VDB-62684, VDB-62683 and VDB-62681 are pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Programming Language Software

Name

• Ruby

Version

• 1.9.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion