It was found that certain methods did not sanitize file names before passing them to lower layer routines in Ruby. If a Ruby application created files with names based on untrusted input, it could result in the creation of files with different names than expected.
(CVE-2012-4522)

It was found that the SLSA-2011:0909 update did not correctly fix the CVE-2011-1005 issue, a flaw in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2012-4481)

This update also fixes the following bug :

  - Prior to this update, the 'rb_syck_mktime' option could,     under certain circumstances, terminate with a     segmentation fault when installing libraries with     certain gems. This update modifies the underlying code     so that Ruby gems can be installed as expected.

It was discovered that Ruby's REXML library did not properly restrict XML entity expansion. An attacker could use this flaw to cause a denial of service by tricking a Ruby application using REXML to read text nodes from specially crafted XML content, which will result in REXML consuming large amounts of system memory. (CVE-2013-1821)

It was found that the RHSA-2011-0910 update did not correctly fix the CVE-2011-1005 issue, a flaw in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2012-4481)

The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname. (CVE-2011-1005)

From Red Hat Security Advisory 2011:0908 :

Updated ruby packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.

A flaw was found in the way large amounts of memory were allocated on 64-bit systems when using the BigDecimal class. A context-dependent attacker could use this flaw to cause memory corruption, causing a Ruby application that uses the BigDecimal class to crash or, possibly, execute arbitrary code. This issue did not affect 32-bit systems.
(CVE-2011-0188)

It was found that WEBrick (the Ruby HTTP server toolkit) did not filter terminal escape sequences from its log files. A remote attacker could use specially crafted HTTP requests to inject terminal escape sequences into the WEBrick log files. If a victim viewed the log files with a terminal emulator, it could result in control characters being executed with the privileges of that user. (CVE-2009-4492)

A cross-site scripting (XSS) flaw was found in the way WEBrick displayed error pages. A remote attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially crafted URL. (CVE-2010-0541)

A flaw was found in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2011-1005)

Red Hat would like to thank Drew Yao of Apple Product Security for reporting the CVE-2011-0188 and CVE-2010-0541 issues.

All Ruby users should upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2011-226:01 advisory.

    Ruby is the interpreted scripting language for quick and easy object-oriented programming.  It has many     features to process text files and to do system management tasks (as in Perl).  It is simple, straight-     forward, and extensible.
    Security issues fixed with this release:
    CVE-2009-4492     WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through     patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which     might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or     overwrite files, via an HTTP request containing an escape sequence for a terminal emulator.
    CVE-2010-0541     Cross-site scripting (XSS) vulnerability in the WEBrick HTTP server in Ruby in Apple Mac OS X 10.5.8, and     10.6 before 10.6.4, allows remote attackers to inject arbitrary web script or HTML via a crafted URI that     triggers a UTF-7 error page.
    CVE-2011-0188     The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on     Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-     dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors     involving creation of a large BigDecimal value within a 64-bit process, related to an integer truncation     issue.
    CVE-2011-1004     The FileUtils.remove_entry_secure method in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330,     1.8.8dev, 1.9.1 through 1.9.1-430, 1.9.2 through 1.9.2-136, and 1.9.3dev allows local users to delete     arbitrary files via a symlink attack.4     CVE-2011-1005     The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows     context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing     an intended pathname.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.6 that does not have Security Update 2012-002 applied. This update contains multiple security-related fixes for the following components :

  - curl
  - Directory Service
  - ImageIO
  - libarchive
  - libsecurity
  - libxml
  - Quartz Composer
  - QuickTime
  - Ruby
  - Samba
  - Security Framework

ID	名稱	產品	系列	已發布	已更新	嚴重性
63603	Scientific Linux Security Update : ruby on SL5.x i386/x86_64 (20130108)	Nessus	Scientific Linux Local Security Checks	2013/1/17	2021/1/14	medium
69732	Amazon Linux AMI : ruby (ALAS-2013-173)	Nessus	Amazon Linux Local Security Checks	2013/9/4	2018/4/18	medium
68297	Oracle Linux 4 : ruby (ELSA-2011-0908)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
283937	MiracleLinux 3 : ruby-1.8.5-19.1.0.1.AXS3 (AXSA:2011-226:01)	Nessus	Miracle Linux Local Security Checks	2026/1/14	2026/1/14	critical
59067	Mac OS X Multiple Vulnerabilities (Security Update 2012-002) (BEAST)	Nessus	MacOS X Local Security Checks	2012/5/10	2024/5/28	critical

偵測

搜尋 Plugin

medium

medium

medium

critical

critical