[Secure-testing-team] Bug#564598: ruby1.8: WEBrick control characters vulnerability

[Daigo Moriwaki]

Package: ruby1.8
Version: 1.8.7.174-3
Severity: grave
Tags: security
Justification: user security hole

The upstream has released a vulnerability fix in WEBrick, a part of Ruby's
standard library.  WEBrick lets attackers to inject malicious escap
e sequences to its logs, making it possible for dangerous control characters
to be executed on a victim's terminal emulator.

-- System Information:
Debian Release: squeeze/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'stable'), (90, 'unstable'), (1, 'experimental')
Architecture: i386 (i686)

Kernel: Linux 2.6.26-2-686 (SMP w/2 CPU cores)
Locale: LANG=ja_JP.eucJP, LC_CTYPE=ja_JP.eucJP (charmap=EUC-JP)
Shell: /bin/sh linked to /bin/bash

Versions of packages ruby1.8 depends on:
ii  libc6                        2.9-4       GNU C Library: Shared libraries
ii  libruby1.8                   1.8.7.174-3 Libraries necessary to run Ruby 1.

ruby1.8 recommends no packages.

Versions of packages ruby1.8 suggests:
ii  rdoc1.8                      1.8.7.174-3 Generate documentation from Ruby s
ii  ri1.8                        1.8.7.174-3 Ruby Interactive reference (for Ru
ii  ruby1.8-examples             1.8.7.174-3 Examples for Ruby 1.8

-- no debconf information