CVE-2012-5380 Path traversal in n/a
Local attackers can gain privileges via DLL hijacking if Ruby is installed in the root directory and PATH is modified by an administrator.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2012-5380?
CVE-2012-5380 is a medium-severity path traversal vulnerability in Ruby-Lang Ruby, published on 11 Oct 2012. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Ruby193\bin directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the Ruby installation
Weakness: CWE-22
Which versions are affected by CVE-2012-5380?
It affects 1 product.
Products include Ruby-Lang Ruby.
How do I fix CVE-2012-5380?
No fix has been published for CVE-2012-5380 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2012-5380 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-5380 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Ruby-Lang Ruby
Sources
Also known as GHSA-jxcg-xrvh-r75f.