Ruby/Gnome2 0.16.0 Format String Vulnerability

2007.11.30
Credit: chris rohlf
Risk: Medium
Local: Yes
Remote: Yes
CWE: CWE-134


CVSS Base Score: 6.8/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

RubyGnome2 0.16.0 Format String Vulnerability In Gtk::MessageDialog http://em386.blogspot.com Ruby Gnome2 is a project to provide GTK2 bindings to ruby scripts so you can write GUI code in less time. There is a format string vulnerability in Gtk::MessageDialog(). This design flaw does not allow for a user generated string to be safely sent to this function. It is really just an API to the GTK2 function gtk_message_dialog_new() Ruby/Gnome2 does not properly use a format specifier for the message variable in ruby-gnome2-all-0.16.0/gtk/src/rbgtkmessagedialog.c as requested by the Gtk man page for this function. ... w = gtk_message_dialog_new(NIL_P(parent) ? NULL : GTK_WINDOW(RVAL2GOBJ(parent)), RVAL2GFLAGS(flags, GTK_TYPE_DIALOG_FLAGS), RVAL2GENUM(type, GTK_TYPE_MESSAGE_TYPE), RVAL2GENUM(buttons, GTK_TYPE_BUTTONS_TYPE), (const gchar*)(NIL_P(message) ? "": RVAL2CSTR(message))); ... The GTK2 documentation: http://www.gtk.org/api/2.6/gtk/GtkMessageDialog.html#gtk-message-dialog- new states that message should be a 'printf style format string' and after that should be arguments to message. However calling messagedialog from your ruby script does not support this. The vulnerability can be exploited by sending a specially crafted string to the function. An example ruby program is provided as a POC. ... #!/usr/bin/env ruby # ruby rubber.rb %x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x require 'libglade2' my_string = ARGV[0] dialog = Gtk::MessageDialog.new(@main_app_window, Gtk::Dialog::MODAL, Gtk::MessageDialog::INFO, Gtk::MessageDialog::BUTTONS_CLOSE, "%s - Was your string!" % my_string) dialog.run dialog.destroy ... A temporary work around for this vulnerability is using the markup member: dialog.markup = "#{my_string} - Was your string!" Or my_string = "my_string = my_string.gsub(/%/, "%%") I have found a few ruby/gnome2 apps out there who use the API in this unsafe manner. Fixed Nov 27th 2007 in Ruby/Gnome2 SVN


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023, cxsecurity.com

 

Back to Top