openSUSE 安全性更新：rubygem-actionmailer (openSUSE-SU-2011:1305-1)
high Nessus Plugin ID 76016
語系：
概要
遠端 openSUSE 主機缺少安全性更新。說明
此 Rails 更新可修正下列安全性問題：CVE-2011-2930 - 透過特製的欄名稱在 quote_table_name 函式中產生的 SQL-injection (bnc#712062) CVE-2011-2931 - strip_tags 協助程式中的跨網站指令碼 (XSS) (bnc#712057) CVE-2011-3186 - 回應分割 (bnc#712058) CVE-2010-3933 - 透過特製的表單參數任意修改記錄 (bnc#712058) CVE-2011-0446 - mail_to 協助程式中的跨網站指令碼 (XSS) (bnc#668817) CVE-2011-0447 - 對「X-Requested-With」標頭進行錯誤驗證 (bnc#668817) CVE-2011-0448 - 因對於 limit 函式進行的錯誤清理引數而造成 SQL-injection (bnc#668817) CVE-2011-0449 - 透過特製的動作名稱繞過存取限制 (bnc#668817)
解決方案
更新受影響的 rubygem-actionmailer 套件。另請參閱
https://bugzilla.novell.com/show_bug.cgi?id=668817
https://bugzilla.novell.com/show_bug.cgi?id=712057
https://bugzilla.novell.com/show_bug.cgi?id=712058
https://bugzilla.novell.com/show_bug.cgi?id=712062
https://lists.opensuse.org/opensuse-updates/2011-12/msg00004.html
Plugin 詳細資訊
嚴重性: High
ID: 76016
檔案名稱: suse_11_4_rubygem-actionmailer-111116.nasl
版本: 1.7
類型: local
代理程式: unix
已發布: 2014/6/13
已更新: 2021/1/19
支援的感應器: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Nessus
風險資訊
VPR
風險因素: Medium
分數: 5.9
CVSS v2
風險因素: High
基本分數: 7.5
時間分數: 5.5
媒介: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
弱點資訊
CPE: p-cpe:/a:novell:opensuse:rubygem-actionmailer, p-cpe:/a:novell:opensuse:rubygem-actionmailer-2_3, p-cpe:/a:novell:opensuse:rubygem-actionmailer-2_3-testsuite, p-cpe:/a:novell:opensuse:rubygem-actionpack, p-cpe:/a:novell:opensuse:rubygem-actionpack-2_3, p-cpe:/a:novell:opensuse:rubygem-actionpack-2_3-testsuite, p-cpe:/a:novell:opensuse:rubygem-activerecord, p-cpe:/a:novell:opensuse:rubygem-activerecord-2_3, p-cpe:/a:novell:opensuse:rubygem-activerecord-2_3-testsuite, p-cpe:/a:novell:opensuse:rubygem-activeresource, p-cpe:/a:novell:opensuse:rubygem-activeresource-2_3, p-cpe:/a:novell:opensuse:rubygem-activeresource-2_3-testsuite, p-cpe:/a:novell:opensuse:rubygem-activesupport, p-cpe:/a:novell:opensuse:rubygem-activesupport-2_3, p-cpe:/a:novell:opensuse:rubygem-rack, p-cpe:/a:novell:opensuse:rubygem-rails, p-cpe:/a:novell:opensuse:rubygem-rails-2_3, cpe:/o:novell:opensuse:11.4
必要的 KB 項目: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
可輕鬆利用: No known exploits are available
修補程式發佈日期: 2011/11/16
參考資訊
CVE: CVE-2010-3933, CVE-2011-0446, CVE-2011-0447, CVE-2011-0448, CVE-2011-0449, CVE-2011-2930, CVE-2011-2931, CVE-2011-3186