CVE:CVE-2014-2888
CNNVD:CNNVD-201404-414
sfpagent gem for Ruby是英国软件开发者Herry所研发的一个SFP代理的Ruby实现。
Ruby的sfpagent gem 0.4.14及之前的版本中的lib/sfpagent/bsig.rb文件中存在安全漏洞。远程攻击者可借助JSON请求的模块名中的shell元字符利用该漏洞执行任意命令。
solution:Upgrade herry sfpagent to a higher version than 0.4.14,0.0.1,0.1.0,0.1.1,0.1.2,0.1.3,0.1.4,0.1.5,0.1.6,0.1.7,0.1.8,0.1.9,0.1.10,0.1.11,0.1.12,0.1.13,0.1.14,0.2.0,0.2.1,0.2.2,0.2.3,0.2.4,0.2.5,0.2.6,0.2.7,0.2.8,0.2.9,0.2.10,0.3.0,0.3.1,0.3.2,0.3.3,0.3.4,0.3.5,0.3.6,0.3.7,0.3.8,0.3.9,0.3.10,0.4.0,0.4.1,0.4.2,0.4.3,0.4.4,0.4.5,0.4.6,0.4.7,0.4.8,0.4.9,0.4.10,0.4.11,0.4.12,0.4.13,and avoid the version (,0.4.14],0.0.1,0.1.0,0.1.1,0.1.2,0.1.3,0.1.4,0.1.5,0.1.6,0.1.7,0.1.8,0.1.9,0.1.10,0.1.11,0.1.12,0.1.13,0.1.14,0.2.0,0.2.1,0.2.2,0.2.3,0.2.4,0.2.5,0.2.6,0.2.7,0.2.8,0.2.9,0.2.10,0.3.0,0.3.1,0.3.2,0.3.3,0.3.4,0.3.5,0.3.6,0.3.7,0.3.8,0.3.9,0.3.10,0.4.0,0.4.1,0.4.2,0.4.3,0.4.4,0.4.5,0.4.6,0.4.7,0.4.8,0.4.9,0.4.10,0.4.11,0.4.12,0.4.13