ID de Prueba:	1.3.6.1.4.1.25623.1.0.66424
Categoría:	Mandrake Local Security Checks
Título:	Mandriva Security Advisory MDVSA-2009:325 (ruby)
Resumen:	The remote host is missing an update to ruby;announced via advisory MDVSA-2009:325.
Descripción:	Summary: The remote host is missing an update to ruby announced via advisory MDVSA-2009:325. Vulnerability Insight: Multiple vulnerabilities was discovered and corrected in ruby: ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate (CVE-2009-0642). The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type (CVE-2009-1904). Packages for 2008.0 are being provided due to extended support for Corporate products. This update provides a solution to these vulnerabilities. Affected: 2008.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0642 BugTraq ID: 33769 http://www.securityfocus.com/bid/33769 http://www.mandriva.com/security/advisories?name=MDVSA-2009:193 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513528 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11450 http://www.redhat.com/support/errata/RHSA-2009-1140.html http://www.securitytracker.com/id?1022505 http://secunia.com/advisories/33750 http://secunia.com/advisories/35699 http://secunia.com/advisories/35937 http://www.ubuntu.com/usn/USN-805-1 XForce ISS Database: ruby-ocspbasicverify-spoofing(48761) https://exchange.xforce.ibmcloud.com/vulnerabilities/48761 Common Vulnerability Exposure (CVE) ID: CVE-2009-1904 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html BugTraq ID: 35278 http://www.securityfocus.com/bid/35278 https://www.redhat.com/archives/fedora-package-announce/2009-December/msg00731.html http://security.gentoo.org/glsa/glsa-200906-02.xml http://www.mandriva.com/security/advisories?name=MDVSA-2009:160 http://mail-index.netbsd.org/pkgsrc-changes/2009/06/10/msg024708.html http://groups.google.com/group/rubyonrails-security/msg/fad60751e2b9b4f6?dmode=source http://osvdb.org/55031 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9780 http://www.securitytracker.com/id?1022371 http://secunia.com/advisories/35399 http://secunia.com/advisories/35527 http://secunia.com/advisories/35593 http://secunia.com/advisories/37705 http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.430805 http://www.vupen.com/english/advisories/2009/1563 XForce ISS Database: ruby-bigdecimal-dos(51032) https://exchange.xforce.ibmcloud.com/vulnerabilities/51032
Copyright	Copyright (C) 2009 E-Soft Inc.

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.