Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Ruby193\bin directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the Ruby installation
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
RubyInstaller 不安全文件系统权限漏洞
Vulnerability Description
Ruby Installer是一个在Windows下的安装程序，用来安装Ruby语言的开发工具和运行环境支持。 RubyInstaller中存在漏洞。可被恶意本地攻击者利用以提升的权限执行某些操作。该漏洞源于应用程序在安装目录设置不安全文件系统权限。攻击者可利用该漏洞以其他用户的权限重写文件（如：C:\Ruby193\bin）并执行程序。1.9.3-p194版本中存在漏洞，其他版本也可能受到影响。
CVSS Information
N/A
Vulnerability Type
N/A