CVE-2011-0995: Privilege Escalation in sqlite3-ruby
Platform
ruby
Component
sqlite3-ruby
Fixed in
1.2.4
CVE-2011-0995 describes a privilege escalation vulnerability found in the sqlite3-ruby gem. This flaw allows a local attacker to potentially gain elevated privileges due to the use of weak permissions on unspecified files. The vulnerability affects versions of sqlite3-ruby up to and including 1.2.3. A fix is available in version 1.2.4.
Detect this CVE in your project
Upload your Gemfile.lock file and we'll tell you instantly if you're affected.
Impact and Attack Scenarios
The primary impact of CVE-2011-0995 is the potential for local privilege escalation. An attacker with local access to the system can exploit this vulnerability to gain unauthorized access to sensitive data or execute commands with elevated privileges. While the CVSS score is LOW, successful exploitation could compromise the integrity of the system and potentially lead to data breaches or further malicious activity. The specific files affected and the precise vectors for exploitation remain unspecified in the available documentation, making a comprehensive risk assessment challenging.
Exploitation Context
CVE-2011-0995 was published in 2017, indicating it has been known for a considerable time. There is no indication of active exploitation campaigns targeting this specific vulnerability. It is not listed on KEV (Known Exploited Vulnerabilities) or EPSS (Emergency Patching Support System). The LOW CVSS score suggests a relatively low probability of exploitation, but the potential for privilege escalation warrants attention.
Threat Intelligence
Exploit Status
EPSS
0.04% (11% percentile)
Affected Software
Timeline
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The recommended mitigation for CVE-2011-0995 is to upgrade the sqlite3-ruby gem to version 1.2.4 or later. If an immediate upgrade is not feasible due to compatibility issues or system downtime constraints, consider implementing stricter file permissions on the affected files (though the specific files are not identified in the CVE). Review system logs for any suspicious activity related to the sqlite3-ruby gem. While no specific WAF or proxy rules are applicable, ensuring robust access controls and limiting local user privileges can reduce the potential impact of this vulnerability.
How to fix
No official patch available. Check for workarounds or monitor for updates.
Frequently asked questions
What is CVE-2011-0995 — Privilege Escalation in sqlite3-ruby?
CVE-2011-0995 is a vulnerability in the sqlite3-ruby gem that allows local users to gain privileges due to weak file permissions. It affects versions up to 1.2.3 and is rated as LOW severity.
Am I affected by CVE-2011-0995 in sqlite3-ruby?
You are affected if you are running SUSE Linux Enterprise (SLE) 11 SP1 and have sqlite3-ruby installed in a version equal to or less than 1.2.3. Check your version using gem list sqlite3-ruby.
How do I fix CVE-2011-0995 in sqlite3-ruby?
Upgrade the sqlite3-ruby gem to version 1.2.4 or later using your system's package manager or gem installation tool. Consult SUSE documentation for specific upgrade instructions.
Is CVE-2011-0995 being actively exploited?
There is no public evidence of active exploitation campaigns targeting CVE-2011-0995. However, the potential for privilege escalation warrants remediation.
Where can I find the official SUSE advisory for CVE-2011-0995?
Refer to the SUSE Security Advisory SUSE-SA-11383 for detailed information and official guidance regarding CVE-2011-0995.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your Gemfile.lock file and we'll tell you instantly if you're affected.
Scan your Ruby project now — no account
Upload your Gemfile.lock and get the vulnerability report instantly. No account. Uploading the file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...