CVE-2014-4996

Name of the Vulnerable Software and Affected Versions VladTheEnterprising gem version 0.2

Description The issue allows local users to write to arbitrary files via a symlink attack on /tmp/my.cnf.#{target host}. This is possible due to a vulnerability in the lib/vlad/dba/mysql.rb file of the VladTheEnterprising gem.

Recommendations For version 0.2 of the VladTheEnterprising gem, consider restricting access to the lib/vlad/dba/mysql.rb file to minimize the risk of exploitation. As a temporary workaround, avoid using the /tmp/my.cnf.#{target host} file in the affected lib/vlad/dba/mysql.rb until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.