|Category:||Ubuntu Local Security Checks|
|Title:||Ubuntu USN-195-1 (ruby1.8)|
|Summary:||Ubuntu USN-195-1 (ruby1.8)|
The remote host is missing an update to ruby1.8
announced via advisory USN-195-1.
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
The following packages are affected: ruby1.8
The object oriented scripting language Ruby supports safely executing
untrusted code with two mechanisms: safe level and taint flag on
objects. Dr. Yutaka Oiwa discovered a vulnerability that allows
Ruby methods to bypass these mechanisms. In systems which use this
feature, this could be exploited to execute Ruby code beyond the
restrictions specified in each safe level.
The problem can be corrected by upgrading the affected package to
version 1.8.1+1.8.2pre2-3ubuntu0.3 (for Ubuntu 4.10), or
1.8.1+1.8.2pre4-1ubuntu0.2 (for Ubuntu 5.04). In general, a standard
system upgrade is sufficient to effect the necessary changes.
However, if you have permanently running server applications which are
implemented in Ruby and use safe levels, you need to restart them.
Risk factor : High
BugTraq ID: 17951|
BugTraq ID: 14909
Common Vulnerability Exposure (CVE) ID: CVE-2005-2337
Debian Security Information: DSA-860 (Google Search)
Debian Security Information: DSA-862 (Google Search)
Debian Security Information: DSA-864 (Google Search)
SuSE Security Announcement: SUSE-SR:2006:005 (Google Search)
Cert/CC Advisory: TA06-132A
CERT/CC vulnerability note: VU#160012
XForce ISS Database: ruby-eval-security-bypass(22360)
|Copyright||Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com|
|This is only one of 56160 vulnerability tests in our test suite. Find out more about running a complete security audit.|
To run a free test of this vulnerability against your system, register below.