Both String and Array have integer overflows. If an attacker can control the size of a string or the index to a string or an array, they can control the address in native memory where Ruby will write data.
The details of these vulnerabilities are not under wraps; they were fixed in commits labelled with their CVE numbers.
I'm getting a different error with x86_64, but probably not protected against other bugs:
(irb):3:in `[]=': failed to allocate memory (NoMemoryError)
from (irb):3:in `irb_binding'
from /usr/lib/ruby/1.8/irb/workspace.rb:52:in `irb_binding'
from /usr/lib/ruby/1.8/irb/workspace.rb:52
9 comments
[ 4.7 ms ] story [ 37.0 ms ] threadhttp://www.matasano.com/log/1070/updates-on-drew-yaos-terrib...
The details of these vulnerabilities are not under wraps; they were fixed in commits labelled with their CVE numbers.
a[0x7fffffff] = 55
(irb):14: [BUG] Segmentation fault
Presumably this is one of the attack vectors that was fixed.
(irb):3:in `[]=': failed to allocate memory (NoMemoryError) from (irb):3:in `irb_binding' from /usr/lib/ruby/1.8/irb/workspace.rb:52:in `irb_binding' from /usr/lib/ruby/1.8/irb/workspace.rb:52
http://dfranke.us/rubyfix.txt