A security vulnerability is found on WEBrick module in Ruby currently shipped on Fedora 12 that WEBrick lets attackers to inject malicious escape sequences to its logs, making it possible for dangerous control characters to be executed on a victim's terminal emulator. This issue has now been tagged as CVE-2009-4492. Also currently have_library() function in mkmf.rb always requires ruby's static archive to function correctly despite that ruby shared library is also provided. This new rpm will fix these issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following several security issues of ruby have been fixed :

  - A race condition allowing local users to delete     arbitrary files. (CVE-2011-1004)

  - Exception methods could bypass safe mode.
    (CVE-2011-1005)

  - webrick does not sanitize non-printable characters in     log. (CVE-2009-4492)

  - A webrick cross-site scripting issue. (CVE-2010-0541)

  - A memory corruption in the BigDecimal class     (CVE-2011-0188)

Updated ruby packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.

A flaw was found in the way large amounts of memory were allocated on 64-bit systems when using the BigDecimal class. A context-dependent attacker could use this flaw to cause memory corruption, causing a Ruby application that uses the BigDecimal class to crash or, possibly, execute arbitrary code. This issue did not affect 32-bit systems.
(CVE-2011-0188)

It was found that WEBrick (the Ruby HTTP server toolkit) did not filter terminal escape sequences from its log files. A remote attacker could use specially crafted HTTP requests to inject terminal escape sequences into the WEBrick log files. If a victim viewed the log files with a terminal emulator, it could result in control characters being executed with the privileges of that user. (CVE-2009-4492)

A cross-site scripting (XSS) flaw was found in the way WEBrick displayed error pages. A remote attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially crafted URL. (CVE-2010-0541)

A flaw was found in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2011-1005)

Red Hat would like to thank Drew Yao of Apple Product Security for reporting the CVE-2011-0188 and CVE-2010-0541 issues.

All Ruby users should upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0909 advisory.

    - Address CVE-2011-1004 'Symlink race condition by removing directory trees in       fileutils module'
      * ruby-1.8.7-CVE-2011-1004.patch
    - Address CVE-2011-1005 'Untrusted codes able to modify arbitrary strings'
      * ruby-1.8.7-CVE-2011-1005.patch
    - Address CVE-2011-0188 'memory corruption in BigDecimal on 64bit platforms'
      * ruby-1.8.7-CVE-2011-0188.patch
    - Address CVE-CVE-2010-0541 'Ruby WEBrick javascript injection flaw'
      * ruby-1.8.7-CVE-2010-0541.patch
    - Address CVE-CVE-2009-4492 'ruby WEBrick log escape sequence'
      * ruby-1.8.6-CVE-2009-4492.patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A vulnerability has been found and corrected in ruby :

WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator (CVE-2009-4492).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

The updated packages have been patched to correct this issue.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.

A flaw was found in the way large amounts of memory were allocated on 64-bit systems when using the BigDecimal class. A context-dependent attacker could use this flaw to cause memory corruption, causing a Ruby application that uses the BigDecimal class to crash or, possibly, execute arbitrary code. This issue did not affect 32-bit systems.
(CVE-2011-0188)

It was found that WEBrick (the Ruby HTTP server toolkit) did not filter terminal escape sequences from its log files. A remote attacker could use specially crafted HTTP requests to inject terminal escape sequences into the WEBrick log files. If a victim viewed the log files with a terminal emulator, it could result in control characters being executed with the privileges of that user. (CVE-2009-4492)

A cross-site scripting (XSS) flaw was found in the way WEBrick displayed error pages. A remote attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially crafted URL. (CVE-2010-0541)

A flaw was found in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2011-1005)

All Ruby users should upgrade to these updated packages, which contain backported patches to resolve these issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
47189	Fedora 12 : ruby-1.8.6.383-6.fc12 (2010-0530)	Nessus	Fedora Local Security Checks	2010/7/1	2021/1/11	medium
54921	SuSE 11.1 Security Update : ruby (SAT Patch Number 4585)	Nessus	SuSE Local Security Checks	2011/5/31	2021/1/19	medium
55837	CentOS 4 : ruby (CESA-2011:0908)	Nessus	CentOS Local Security Checks	2011/8/15	2021/1/4	medium
68298	Oracle Linux 5 : ruby (ELSA-2011-0909)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2025/4/29	critical
44061	Mandriva Linux Security Advisory : ruby (MDVSA-2010:017)	Nessus	Mandriva Local Security Checks	2010/1/20	2021/1/6	medium
61075	Scientific Linux Security Update : ruby on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	2012/8/1	2021/1/14	medium

检测

插件搜索

medium

medium

medium

critical

medium

medium