The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0011 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language.
    It has features to process text files and to perform system management     tasks.

    A buffer overflow flaw was found in the way Ruby parsed floating point     numbers from their text representation. If an application using Ruby     accepted untrusted input strings and converted them to floating point     numbers, an attacker able to provide such input could cause the application     to crash or, possibly, execute arbitrary code with the privileges of the     application. (CVE-2013-4164)

    Users of Red Hat OpenStack 3.0 are advised to upgrade to these updated     packages, which correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1764 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language.
    It has features to process text files and to perform system management     tasks.

    A buffer overflow flaw was found in the way Ruby parsed floating point     numbers from their text representation. If an application using Ruby     accepted untrusted input strings and converted them to floating point     numbers, an attacker able to provide such input could cause the application     to crash or, possibly, execute arbitrary code with the privileges of the     application. (CVE-2013-4164)

    All ruby users are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Solaris system is missing necessary patches to address security updates :

  - Heap-based buffer overflow in Ruby 1.8, 1.9 before     1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0     preview2, and trunk before revision 43780 allows     context-dependent attackers to cause a denial of service     (segmentation fault) and possibly execute arbitrary code     via a string that is converted to a floating point     value, as demonstrated using (1) the to_f method or (2)     JSON.parse. (CVE-2013-4164)

  - Algorithmic complexity vulnerability in     Gem::Version::VERSION_PATTERN in lib/     rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24     through 1.8.25, 2.0.x before 2.0.8, and 2.1.x before     2.1.0, as used in Ruby 1.9.0 through 2.0.0p247, allows     remote attackers to cause a denial of service (CPU     consumption) via a crafted gem version that triggers a     large amount of backtracking in a regular expression.
    (CVE-2013-4287)

  - Algorithmic complexity vulnerability in     Gem::Version::ANCHORED_VERSION_PATTERN in     lib/rubygems/version.rb in RubyGems before 1.8.23.2,     1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x     before 2.1.5, as used in Ruby 1.9.0 through 2.0.0p247,     allows remote attackers to cause a denial of service     (CPU consumption) via a crafted gem version that     triggers a large amount of backtracking in a regular     expression. NOTE: this issue is due to an incomplete fix     for CVE-2013-4287. (CVE-2013-4363)

Ruby developers report :

Any time a string is converted to a floating point value, a specially crafted string can cause a heap overflow. This can lead to a denial of service attack via segmentation faults and possibly arbitrary code execution. Any program that converts input of unknown origin to floating point values (especially common when accepting JSON) are vulnerable.

A vulnerability was found and corrected in ruby :

Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse (CVE-2013-4164).

The updated packages have been patched to correct these issues.

Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse.

A buffer overflow flaw was found in the way Ruby parsed floating point numbers from their text representation. If an application using Ruby accepted untrusted input strings and converted them to floating point numbers, an attacker able to provide such input could cause the application to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2013-4164)

The following security issue was fixed in ruby19 :

the following security issue was fixed in ruby20 :

  - fix CVE-2013-4164: heap overflow in float point parsing     (bnc#851803) The file CVE-2013-4164.patch contains the     patch

The remote host is affected by the vulnerability described in GLSA-201412-27 (Ruby: Denial of Service)

    Multiple vulnerabilities have been discovered in Ruby. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could possibly execute arbitrary code with       the privileges of the process, cause a Denial of Service condition, or       bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

The remote Mac OS X host has a version of OS X Server installed that is prior to version 4.0.  It is, therefore, affected by the following vulnerabilities :

  - There are multiple vulnerabilities within the included     BIND, the most serious of which can lead to a denial of     service. (CVE-2013-3919, CVE-2013-4854, CVE-2014-0591)

  - There are multiple vulnerabilities within the included     LibYAML for the Profile Manager and ServerRuby, the most     serious of which can lead to arbitrary code execution.
    (CVE-2013-4164, CVE-2013-6393)

  - There are multiple vulnerabilities within the included     PostgreSQL, the most serious of which can lead to     arbitrary code execution. (CVE-2014-0060, CVE-2014-0061,     CVE-2014-0062, CVE-2014-0063, CVE-2014-0064,     CVE-2014-0065, CVE-2014-0066)

  - An error exists related to the way SSL 3.0 handles     padding bytes when decrypting messages encrypted using     block ciphers in cipher block chaining (CBC) mode. A     man-in-the-middle attacker can decrypt a selected byte     of a cipher text in as few as 256 tries if they are able     to force a victim application to repeatedly send the     same data over newly created SSL 3.0 connections. This     is also known as the 'POODLE' issue. (CVE-2014-3566)

  - A cross-site scripting flaw exists in the Xcode Server     due to not properly validating input before returning it     to the user. This can allow a remote attacker, using a     specially crafted request, to execute code within the     browser / server trust relationship. (CVE-2014-4406)

  - A SQL injection flaw exists in the Wiki Server due to     not properly sanitizing user input before using it in     SQL queries. This can allow a remote attacker, using a     specially crafted request, to inject or manipulate SQL     queries, thus allowing the manipulation or disclosure     of arbitrary data. (CVE-2014-4424)

  - A restriction bypass flaw exists in the Mail Server due     to SCAL changes being cached and not enforced until the     service had restarted. This can allow an authenticated     remote attacker to bypass those restrictions.
    (CVE-2014-4446)

  - A password disclosure flaw exists in the Profile Manager     due to passwords being potentially saved to a file when     editing or setting up a profile. This can allow a local     attacker to gain access to password information.
    (CVE-2014-4447)

An overflow in floating point number parsing was found in Ruby currently being shipped on Fedora 19. This vulnerability has been assigned the CVE identifier CVE-2013-4164.

This new rpm should fix this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Update to Ruby 2.0.0-p353. This includes fix to an overflow in floating point number parsing found in Ruby currently being shipped on Fedora 20. This vulnerability has been assigned the CVE identifier CVE-2013-4164. This new rpm should fix this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1767 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language.
    It has features to process text files and to perform system management     tasks.

    A buffer overflow flaw was found in the way Ruby parsed floating point     numbers from their text representation. If an application using Ruby     accepted untrusted input strings and converted them to floating point     numbers, an attacker able to provide such input could cause the application     to crash or, possibly, execute arbitrary code with the privileges of the     application. (CVE-2013-4164)

    All ruby users are advised to upgrade to these updated packages, which     contain a backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
234422	RHEL 6 : ruby193-ruby (RHSA-2014:0011)	Nessus	Red Hat Local Security Checks	2025/4/15	2025/4/15	critical
71093	RHEL 6 : ruby (RHSA-2013:1764)	Nessus	Red Hat Local Security Checks	2013/11/26	2025/4/15	critical
80757	Oracle Solaris Third-Party Patch Update : ruby (multiple_vulnerabilities_in_ruby1)	Nessus	Solaris Local Security Checks	2015/1/19	2021/1/14	medium
71072	FreeBSD : ruby -- Heap Overflow in Floating Point Parsing (cc9043cf-7f7a-426e-b2cc-8d1980618113)	Nessus	FreeBSD Local Security Checks	2013/11/25	2021/1/6	medium
71100	Mandriva Linux Security Advisory : ruby (MDVSA-2013:286)	Nessus	Mandriva Local Security Checks	2013/11/27	2021/1/6	medium
71079	Amazon Linux AMI : ruby (ALAS-2013-248)	Nessus	Amazon Linux Local Security Checks	2013/11/26	2018/4/18	medium
71202	Scientific Linux Security Update : ruby on SL6.x i386/x86_64 (20131125)	Nessus	Scientific Linux Local Security Checks	2013/12/4	2021/1/14	medium
75221	openSUSE Security Update : ruby19 (openSUSE-SU-2013:1835-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
75224	openSUSE Security Update : ruby20 (openSUSE-SU-2013:1834-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/19	medium
79980	GLSA-201412-27 : Ruby: Denial of Service	Nessus	Gentoo Local Security Checks	2014/12/15	2021/1/6	high
78601	Mac OS X : OS X Server < 4.0 Multiple Vulnerabilities (POODLE)	Nessus	MacOS X Local Security Checks	2014/10/21	2023/6/23	medium
71328	Fedora 18 : ruby-1.9.3.484-32.fc18 (2013-22315)	Nessus	Fedora Local Security Checks	2013/12/11	2021/1/11	medium
71410	Fedora 20 : ruby-2.0.0.353-16.fc20 (2013-22393)	Nessus	Fedora Local Security Checks	2013/12/14	2021/1/11	medium
78982	RHEL 6 : ruby (RHSA-2013:1767)	Nessus	Red Hat Local Security Checks	2014/11/8	2025/4/15	critical

检测

插件搜索

critical

critical

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

critical