RubyGems rgpg 'gpg _ helper. rb' Remote Command Injection Vulnerability

Release date: 2013-08-02
Updated on:

Affected Systems:
Rubygems rgpg 0.2.3
Description:
--------------------------------------------------------------------------------
Bugtraq id: 61575

Rgpg is a simple API for interacting with gpg tools.

Rgpg passes user input that does not have valid filtering to the System () function for execution. If this API is used in the context of the rail application, if the user provides shell metacharacters similar to ";", "&" in lib/rgpg/gpg_helper.rb, it is possible to inject remote commands in shell. Attackers can exploit this vulnerability to execute arbitrary commands in the context of the affected application.

<* Source: Larry W. Cashdollar (lwc@vapid.dhs.org)

Link: http://seclists.org/oss-sec/2013/q3/266
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Rubygems
--------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Https://rubygems.org/gems/rgpg