CVE-2014-3248

What it actually does

Untrusted search path vulnerability allows a local process running with Ruby 1.9.1 or earlier to load and execute attacker-controlled Ruby files or shared libraries from the current working directory instead of trusted system locations, resulting in privilege escalation.

Why it matters to the business

Local attackers on affected systems can obtain elevated privileges, potentially taking control of configuration management tools and the systems they manage, leading to widespread unauthorized access or disruption.

How an attack unfolds

An attacker with local access places a malicious file matching one of the expected names in the working directory of a vulnerable process; when the process starts under Ruby 1.9.1 or earlier, it loads the Trojan instead of the legitimate library, executing attacker code with the privileges of the running service.

How to fix it

Upgrade affected components to fixed versions; for typo3 (Bitnami) apply the update to 9.5.42 or later. Where upgrades are not immediately possible, restrict write access to directories from which these processes are launched and avoid running under Ruby 1.9.1 or earlier.

How to confirm the fix worked

Verify installed package versions against the fixed releases, confirm that Ruby 1.9.1 or earlier is no longer in use with the affected tools, and test that processes no longer load files from the current working directory when expected system paths are present.

Typical attack path

1. Obtain local access to a system running an affected version
2. Identify the working directory used by the vulnerable component
3. Place a Trojan horse file using one of the demonstrated names in that directory
4. Trigger execution of the vulnerable binary or service
5. Gain elevated privileges via the loaded malicious code

How to detect it

Review process execution logs and file access traces for unexpected loads of the named Ruby or shared-object files from non-system directories; examine startup scripts and working directories for the presence of the listed Trojan file names.

• rubygems/defaults/operating_system.rb
• Win32API.rb
• Win32API.so
• safe_yaml.rb
• safe_yaml/deep.rb
• safe_yaml/deep.so
• operatingsystem.rb
• operatingsystem.so
• osfamily.rb
• osfamily.so

What your security team should do

• Apply the available fixed versions immediately given the public exploit availability
• Audit systems for any remaining use of Ruby 1.9.1 or earlier with these components
• Harden working directory permissions for configuration management services
• Monitor for unexpected file loads during process startup