Test ID:	1.3.6.1.4.1.25623.1.0.55554
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-195-1 (ruby1.8)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to ruby1.8 announced via advisory USN-195-1. A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) Ubuntu 5.04 (Hoary Hedgehog) The following packages are affected: ruby1.8 The object oriented scripting language Ruby supports safely executing untrusted code with two mechanisms: safe level and taint flag on objects. Dr. Yutaka Oiwa discovered a vulnerability that allows Ruby methods to bypass these mechanisms. In systems which use this feature, this could be exploited to execute Ruby code beyond the restrictions specified in each safe level. Solution: The problem can be corrected by upgrading the affected package to version 1.8.1+1.8.2pre2-3ubuntu0.3 (for Ubuntu 4.10), or 1.8.1+1.8.2pre4-1ubuntu0.2 (for Ubuntu 5.04). In general, a standard system upgrade is sufficient to effect the necessary changes. However, if you have permanently running server applications which are implemented in Ruby and use safe levels, you need to restart them. http://www.securityspace.com/smysecure/catid.html?in=USN-195-1 Risk factor : High CVSS Score: 7.5
Cross-Ref:	BugTraq ID: 17951 BugTraq ID: 14909 Common Vulnerability Exposure (CVE) ID: CVE-2005-2337 http://lists.apple.com/archives/security-announce/2006/May/msg00003.html http://www.securityfocus.com/bid/14909 http://www.securityfocus.com/bid/17951 Cert/CC Advisory: TA06-132A http://www.us-cert.gov/cas/techalerts/TA06-132A.html CERT/CC vulnerability note: VU#160012 http://www.kb.cert.org/vuls/id/160012 Debian Security Information: DSA-860 (Google Search) http://www.debian.org/security/2005/dsa-860 Debian Security Information: DSA-862 (Google Search) http://www.debian.org/security/2005/dsa-862 Debian Security Information: DSA-864 (Google Search) http://www.debian.org/security/2005/dsa-864 http://www.gentoo.org/security/en/glsa/glsa-200510-05.xml http://www.mandriva.com/security/advisories?name=MDKSA-2005:191 http://jvn.jp/jp/JVN%2362914675/index.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10564 http://www.redhat.com/support/errata/RHSA-2005-799.html http://www.securitytracker.com/alerts/2005/Sep/1014948.html http://secunia.com/advisories/16904 http://secunia.com/advisories/17094 http://secunia.com/advisories/17098 http://secunia.com/advisories/17129 http://secunia.com/advisories/17147 http://secunia.com/advisories/17285 http://secunia.com/advisories/19130 http://secunia.com/advisories/20077 http://securityreason.com/securityalert/59 SuSE Security Announcement: SUSE-SR:2006:005 (Google Search) http://www.novell.com/linux/security/advisories/2006_05_sr.html http://www.ubuntu.com/usn/usn-195-1 http://www.vupen.com/english/advisories/2006/1779 XForce ISS Database: ruby-eval-security-bypass(22360) https://exchange.xforce.ibmcloud.com/vulnerabilities/22360
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.