Several vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-1821     Ben Murphy discovered that unrestricted entity expansion     in REXML can lead to a Denial of Service by consuming     all host memory.

  - CVE-2013-4073     William (B.J.) Snow Orvis discovered a vulnerability in     the hostname checking in Ruby's SSL client that could     allow man-in-the-middle attackers to spoof SSL servers     via a crafted certificate issued by a trusted     certification authority.

  - CVE-2013-4164     Charlie Somerville discovered that Ruby incorrectly     handled floating point number conversion. If an     application using Ruby accepted untrusted input strings     and converted them to floating point numbers, an     attacker able to provide such input could cause the     application to crash or, possibly, execute arbitrary     code with the privileges of the application.

According to its banner, the version of PHP installed on the remote host is 5.3.x prior to 5.3.28.  It is, therefore, potentially affected by the following vulnerabilities :

  - A flaw exists in the PHP OpenSSL extension's hostname     identity check when handling certificates that contain     hostnames with NULL bytes. An attacker could potentially     exploit this flaw to conduct man-in-the-middle attacks     to spoof SSL servers. Note that to exploit this issue,     an attacker would need to obtain a carefully-crafted     certificate signed by an authority that the client     trusts. (CVE-2013-4073, CVE-2013-4248) 

  - A memory corruption flaw exists in the way the     openssl_x509_parse() function of the PHP OpenSSL     extension parsed X.509 certificates. A remote attacker     could use this flaw to provide a malicious, self-signed     certificate or a certificate signed by a trusted     authority to a PHP application using the aforementioned     function. This could cause the application to crash or     possibly allow the attacker to execute arbitrary code     with the privileges of the user running the PHP     interpreter. (CVE-2013-6420)

Note that this plugin does not attempt to exploit these vulnerabilities, but instead relies only on PHP's self-reported version number.

The remote host is running a version of Mac OS X 10.7 or 10.8 that does not have Security Update 2014-001 applied. This update contains several security-related fixes for the following components :

  - Apache
  - App Sandbox
  - ATS
  - Certificate Trust Policy
  - CFNetwork Cookies
  - CoreAnimation
  - Date and Time
  - File Bookmark
  - ImageIO
  - IOSerialFamily
  - LaunchServices
  - NVIDIA Drivers
  - PHP
  - QuickLook
  - QuickTime
  - Secure Transport

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-1090 advisory.

    - Fix regression introduced by CVE-2013-4073       https://bugs.ruby-lang.org/issues/8575
      * ruby-2.0.0-p255-Fix-SSL-client-connection-crash-for-SAN-marked-critical.patch
      - Related: rhbz#979300

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of Mac OS X 10.x that is prior to version 10.9. The newer version contains multiple security-related fixes for the following components :

  - Application Firewall
  - App Sandbox
  - Bluetooth
  - CFNetwork
  - CFNetwork SSL
  - Console
  - CoreGraphics
  - curl
  - dyld
  - IOKitUser
  - IOSerialFamily
  - Kernel
  - Kext Management
  - LaunchServices
  - Libc
  - Mail Accounts
  - Mail Header Display
  - Mail Networking
  - OpenLDAP
  - perl
  - Power Management
  - python
  - ruby
  - Security
  - Security - Authorization
  - Security - Smart Card Services
  - Screen Lock
  - Screen Sharing Server
  - syslog
  - USB

The remote Solaris system is missing necessary patches to address security updates :

  - The safe-level feature in Ruby 1.8.6 through 1.8.6-420,     1.8.7 through 1.8.7-330, and 1.8.8dev allows     context-dependent attackers to modify strings via the     Exception#to_s method, as demonstrated by changing an     intended pathname. (CVE-2011-1005)

  - The safe-level feature in Ruby 1.8.7 allows     context-dependent attackers to modify strings via the     NameError#to_s method when operating on Ruby objects.
    NOTE: this issue is due to an incomplete fix for     CVE-2011-1005. (CVE-2012-4481)

  - The OpenSSL::SSL.verify_certificate_identity function in     lib/openssl/ssl.rb in Ruby 1.8 before 1.8.7-p374, 1.9     before 1.9.3-p448, and 2.0 before 2.0.0-p247 does not     properly handle a '\0' character in a domain name in the     Subject Alternative Name field of an X.509 certificate,     which allows man-in-the-middle attackers to spoof     arbitrary SSL servers via a crafted certificate issued     by a legitimate Certification Authority, a related issue     to CVE-2009-2408. (CVE-2013-4073)

Updated ruby193-ruby packages that fix one security issue are now available for Red Hat OpenShift Enterprise 1.2.2.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.

A flaw was found in Ruby's SSL client's hostname identity check when handling certificates that contain hostnames with NULL bytes. An attacker could potentially exploit this flaw to conduct man-in-the-middle attacks to spoof SSL servers. Note that to exploit this issue, an attacker would need to obtain a carefully-crafted certificate signed by an authority that the client trusts.
(CVE-2013-4073)

All users of Red Hat OpenShift Enterprise 1.2.2 are advised to upgrade to these updated packages, which resolve this issue.

William (B.J.) Snow Orvis discovered that Ruby incorrectly verified the hostname in SSL certificates. An attacker could trick Ruby into trusting a rogue server certificate, which was signed by a trusted certificate authority, to perform a man-in-the-middle attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ruby Developers report :

Ruby's SSL client implements hostname identity check but it does not properly handle hostnames in the certificate that contain null bytes.

- fix cve-2013-4073 (bnc#827265) The     fix_cve-2013-4073.patch contains the patch for     cve-2013-4073 (bnc#827265) adapted from     https://github.com/ruby/ruby/commit/2669b84d407ab431e965     145c827db66c91158f89

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
71220	Debian DSA-2809-1 : ruby1.8 - several vulnerabilities	Nessus	Debian Local Security Checks	2013/12/5	2021/1/11	medium
71426	PHP 5.3.x < 5.3.28 Multiple OpenSSL Vulnerabilities	Nessus	CGI abuses	2013/12/14	2025/5/26	high
72688	Mac OS X Multiple Vulnerabilities (Security Update 2014-001) (BEAST)	Nessus	MacOS X Local Security Checks	2014/2/25	2024/5/28	critical
68976	Oracle Linux 5 / 6 : ruby (ELSA-2013-1090)	Nessus	Oracle Linux Local Security Checks	2013/7/19	2024/10/22	medium
70561	Mac OS X 10.x < 10.9 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	2013/10/23	2024/5/28	high
80755	Oracle Solaris Third-Party Patch Update : ruby (cve_2013_4073_cryptographic_issues)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
119342	RHEL 6 : ruby193-ruby (RHSA-2013:1137)	Nessus	Red Hat Local Security Checks	2018/12/4	2024/7/17	medium
67224	Ubuntu 12.04 LTS / 12.10 / 13.04 : ruby1.8, ruby1.9.1 vulnerability (USN-1902-1)	Nessus	Ubuntu Local Security Checks	2013/7/10	2019/9/19	medium
67251	FreeBSD : ruby -- Hostname check bypassing vulnerability in SSL client (ebd877b9-7ef4-4375-b1fd-c67780581898)	Nessus	FreeBSD Local Security Checks	2013/7/12	2021/1/6	medium
75082	openSUSE Security Update : ruby19 (openSUSE-SU-2013:1181-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium

检测

插件搜索

medium

high

critical

medium

high

medium

medium

medium

medium

medium