CVE-2010-0541
published 2010-06-17CVE-2010-0541: Cross-site scripting (XSS) vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject…
PriorityP418medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
2.81%
85.1th percentile
Cross-site scripting (XSS) vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x | — | — |
| apple | mac_os_x_server | — | — |
| apple | mac_os_x_server | — | — |
| apple | mac_os_x_server | — | — |
| apple | mac_os_x_server | — | — |
| apple | mac_os_x_server | — | — |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_redhat4.3MEDIUM
vendor_ubuntu4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Ruby vulnerabilities
vendor_ubuntu·2012-02-28·CVSS 4.3
CVE-2010-0541 [MEDIUM] Ruby vulnerabilities
Title: Ruby vulnerabilities
Summary: Several security issues were fixed in ruby1.8.
Drew Yao discovered that the WEBrick HTTP server was vulnerable to cross-site
scripting attacks when displaying error pages. A remote attacker could use this
flaw to run arbitrary web script. (CVE-2010-0541)
Drew Yao discovered that Ruby's BigDecimal module did not properly allocate
memory on 64-bit platforms. An attacker could use this flaw to cause a denial
of service or possibly execute arbitrary code with user privileges.
(CVE-2011-0188)
Nicholas Jefferson discovered that the FileUtils.remove_entry_secure method in
Ruby did not properly remove non-empty directories. An attacker could use this
flaw to possibly delete arbitrary files. (CVE-2011-1004)
It was discovered that Ruby incorrectly allowed un
Red Hat
Ruby WEBrick javascript injection flaw
vendor_redhat·2010-05-27·CVSS 4.3
CVE-2010-0541 [MEDIUM] Ruby WEBrick javascript injection flaw
Ruby WEBrick javascript injection flaw
Cross-site scripting (XSS) vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page.
Package: ruby (Red Hat Enterprise Linux 6) - Not affected
GHSA
GHSA-h9r2-943c-qg8v: Cross-site scripting (XSS) vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10
ghsa_unreviewed·2022-05-02
CVE-2010-0541 [MEDIUM] CWE-79 GHSA-h9r2-943c-qg8v: Cross-site scripting (XSS) vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10
Cross-site scripting (XSS) vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that triggers a UTF-7 error page.
No detection rules found.
Bugzilla
CVE-2010-3879 CVE-2011-0541 CVE-2011-0542 CVE-2011-0543 fuse: unprivileged user can unmount arbitrary locations via symlink attack
bugzilla·2010-11-08·CVSS 5.8
CVE-2010-3879 [MEDIUM] CVE-2010-3879 CVE-2011-0541 CVE-2011-0542 CVE-2011-0543 fuse: unprivileged user can unmount arbitrary locations via symlink attack
CVE-2010-3879 CVE-2011-0541 CVE-2011-0542 CVE-2011-0543 fuse: unprivileged user can unmount arbitrary locations via symlink attack
It was reported [1],[2] that the fusermount tool was vulnerable to a race condition between mounting a user filesystem and updating mtab using the standard mount command. If a user were able to win the race, the real mount entry and the mtab entry would differ, making the fuse-mounted filesystem not unmountable by an unprivileged user. Crafted mtab entries can then be used to trick fusermount into believing that a certain part of the filesystem is a user-space filesystem, and will unmount what should be a privileged filesystem (as demonstrated by unmounting /proc).
According to the SUSE bug report [3], this would affect fuse versions before 2.8.2 or util-linu
Bugzilla
CVE-2010-0541 Ruby WEBrick javascript injection flaw [fedora-all]
bugzilla·2010-06-17·CVSS 4.3
CVE-2010-0541 [MEDIUM] CVE-2010-0541 Ruby WEBrick javascript injection flaw [fedora-all]
CVE-2010-0541 Ruby WEBrick javascript injection flaw [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected Fedora
versions.
For comments that are specific to the vulnerability please use bugs filed
against "Security Response" product referenced in the "Blocks" field.
Forr more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please include the bug IDs of the
respective parent bugs filed against the "Security Response" product.
Please mention CVE ids in the RPM changelog when available.
Bodhi update submission link:
https://admin.fedoraproject.org/updates/new/?type_=security&bugs=587731
Please note: this issue affects multiple support
Bugzilla
CVE-2010-0541 Ruby WEBrick javascript injection flaw
bugzilla·2010-04-30·CVSS 4.3
CVE-2010-0541 [MEDIUM] CVE-2010-0541 Ruby WEBrick javascript injection flaw
CVE-2010-0541 Ruby WEBrick javascript injection flaw
Impact: A remote attacker may gain access to accounts served by Ruby
WEBrick
Description: A cross-site scripting issue exists in the Ruby WEBrick
HTTP server's handling of error pages. Accessing a maliciously
crafted URL in certain web browsers may cause the error page to be
treated as UTF-7, allowing JavaScript injection. This update
addresses the issue by setting UTF-8 as the default character set in
HTTP error responses. Credit: Apple.
Discussion:
Suggested patch from Apple:
--- lib/webrick/httpresponse.rb.old 2010-03-31 18:47:40.000000000 -0700
+++ lib/webrick/httpresponse.rb 2010-03-31 18:48:21.000000000 -0700
@@ -209,7 +209,7 @@
@keep_alive = false
self.status = HTTPStatus::RC_INTERNAL_SERVER_ERROR
end
- @header['content-type'
http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.htmlhttp://secunia.com/advisories/40220http://support.apple.com/kb/HT4188http://www.mandriva.com/security/advisories?name=MDVSA-2011:097http://www.mandriva.com/security/advisories?name=MDVSA-2011:098http://www.redhat.com/support/errata/RHSA-2011-0908.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0909.htmlhttp://www.securityfocus.com/bid/40871http://www.securityfocus.com/bid/40895http://www.vupen.com/english/advisories/2010/1481http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.htmlhttp://secunia.com/advisories/40220http://support.apple.com/kb/HT4188http://www.mandriva.com/security/advisories?name=MDVSA-2011:097http://www.mandriva.com/security/advisories?name=MDVSA-2011:098http://www.redhat.com/support/errata/RHSA-2011-0908.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0909.htmlhttp://www.securityfocus.com/bid/40871http://www.securityfocus.com/bid/40895http://www.vupen.com/english/advisories/2010/1481
2010-06-17
Published