ID de Prueba:	1.3.6.1.4.1.25623.1.0.870449
Categoría:	Red Hat Local Security Checks
Título:	RedHat Update for ruby RHSA-2011:0908-01
Resumen:	The remote host is missing an update for the 'ruby'; package(s) announced via the referenced advisory.
Descripción:	Summary: The remote host is missing an update for the 'ruby' package(s) announced via the referenced advisory. Vulnerability Insight: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. A flaw was found in the way large amounts of memory were allocated on 64-bit systems when using the BigDecimal class. A context-dependent attacker could use this flaw to cause memory corruption, causing a Ruby application that uses the BigDecimal class to crash or, possibly, execute arbitrary code. This issue did not affect 32-bit systems. (CVE-2011-0188) It was found that WEBrick (the Ruby HTTP server toolkit) did not filter terminal escape sequences from its log files. A remote attacker could use specially-crafted HTTP requests to inject terminal escape sequences into the WEBrick log files. If a victim viewed the log files with a terminal emulator, it could result in control characters being executed with the privileges of that user. (CVE-2009-4492) A cross-site scripting (XSS) flaw was found in the way WEBrick displayed error pages. A remote attacker could use this flaw to perform a cross-site scripting attack against victims by tricking them into visiting a specially-crafted URL. (CVE-2010-0541) A flaw was found in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2011-1005) Red Hat would like to thank Drew Yao of Apple Product Security for reporting the CVE-2011-0188 and CVE-2010-0541 issues. All Ruby users should upgrade to these updated packages, which contain backported patches to resolve these issues. Affected Software/OS: ruby on Red Hat Enterprise Linux AS version 4, Red Hat Enterprise Linux ES version 4, Red Hat Enterprise Linux WS version 4 Solution: Please Install the Updated Packages. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-4492 BugTraq ID: 37710 http://www.securityfocus.com/bid/37710 Bugtraq: 20100110 Nginx, Varnish, Cherokee, thttpd, mini-httpd, WEBrick, Orion, AOLserver, Yaws and Boa log escape sequence injection (Google Search) http://www.securityfocus.com/archive/1/508830/100/0/threaded http://www.ush.it/team/ush/hack_httpd_escape/adv.txt http://www.redhat.com/support/errata/RHSA-2011-0908.html http://www.redhat.com/support/errata/RHSA-2011-0909.html http://securitytracker.com/id?1023429 http://secunia.com/advisories/37949 http://www.vupen.com/english/advisories/2010/0089 Common Vulnerability Exposure (CVE) ID: CVE-2010-0541 http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.html BugTraq ID: 40871 http://www.securityfocus.com/bid/40871 BugTraq ID: 40895 http://www.securityfocus.com/bid/40895 http://www.mandriva.com/security/advisories?name=MDVSA-2011:097 http://www.mandriva.com/security/advisories?name=MDVSA-2011:098 http://secunia.com/advisories/40220 http://www.vupen.com/english/advisories/2010/1481 Common Vulnerability Exposure (CVE) ID: CVE-2011-0188 http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html http://www.redhat.com/support/errata/RHSA-2011-0910.html http://www.securitytracker.com/id?1025236 Common Vulnerability Exposure (CVE) ID: CVE-2011-1005 43420 http://secunia.com/advisories/43420 43573 http://secunia.com/advisories/43573 46458 http://www.securityfocus.com/bid/46458 70957 http://osvdb.org/70957 ADV-2011-0539 http://www.vupen.com/english/advisories/2011/0539 APPLE-SA-2012-05-09-1 http://lists.apple.com/archives/security-announce/2012/May/msg00001.html FEDORA-2011-1876 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054422.html FEDORA-2011-1913 http://lists.fedoraproject.org/pipermail/package-announce/2011-March/054436.html MDVSA-2011:097 MDVSA-2011:098 RHSA-2011:0908 RHSA-2011:0909 RHSA-2011:0910 [oss-security] 20110221 CVE request: ruby: FileUtils is vulnerable to symlink race attacks + Exception methods can bypass $SAFE http://www.openwall.com/lists/oss-security/2011/02/21/2 [oss-security] 20110221 Re: CVE request: ruby: FileUtils is vulnerable to symlink race attacks + Exception methods can bypass $SAFE http://www.openwall.com/lists/oss-security/2011/02/21/5 http://support.apple.com/kb/HT5281 http://www.ruby-lang.org/en/news/2011/02/18/exception-methods-can-bypass-safe/ https://bugzilla.redhat.com/show_bug.cgi?id=678920
Copyright	Copyright (C) 2011 Greenbone AG

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.