Test ID:	1.3.6.1.4.1.25623.1.0.55666
Category:	Conectiva Local Security Checks
Title:	Conectiva Security Advisory CLSA-2005:1030
Summary:	Conectiva Security Advisory CLSA-2005:1030
Description:	The remote host is missing updates announced in advisory CLSA-2005:1030. Ruby supports safe execution of untrusted code with two mechanisms: safe level and taint flag on objects. Dr. Yutaka Oiwa discovered a vulnerability that allows Ruby methods to bypass these mechanisms. In systems which use this feature, this could be exploited to execute Ruby code beyond the restrictions specified in each safe level. Solution: The apt tool can be used to perform RPM package upgrades by running 'apt-get update' followed by 'apt-get upgrade' http://distro.conectiva.com.br/atualizacoes/index.php?id=a&anuncio=001030 http://www.ruby-lang.org/ Risk factor : High
Cross-Ref:	BugTraq ID: 17951 BugTraq ID: 14909 Common Vulnerability Exposure (CVE) ID: CVE-2005-2337 http://lists.apple.com/archives/security-announce/2006/May/msg00003.html Debian Security Information: DSA-860 (Google Search) http://www.debian.org/security/2005/dsa-860 Debian Security Information: DSA-862 (Google Search) http://www.debian.org/security/2005/dsa-862 Debian Security Information: DSA-864 (Google Search) http://www.debian.org/security/2005/dsa-864 http://www.gentoo.org/security/en/glsa/glsa-200510-05.xml http://www.mandriva.com/security/advisories?name=MDKSA-2005:191 http://www.redhat.com/support/errata/RHSA-2005-799.html SuSE Security Announcement: SUSE-SR:2006:005 (Google Search) http://www.novell.com/linux/security/advisories/2006_05_sr.html http://www.ubuntu.com/usn/usn-195-1 Cert/CC Advisory: TA06-132A http://www.us-cert.gov/cas/techalerts/TA06-132A.html CERT/CC vulnerability note: VU#160012 http://www.kb.cert.org/vuls/id/160012 http://jvn.jp/jp/JVN%2362914675/index.html http://www.securityfocus.com/bid/14909 http://www.securityfocus.com/bid/17951 http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10564 http://www.vupen.com/english/advisories/2006/1779 http://www.securitytracker.com/alerts/2005/Sep/1014948.html http://secunia.com/advisories/16904 http://secunia.com/advisories/17094 http://secunia.com/advisories/17129 http://secunia.com/advisories/17147 http://secunia.com/advisories/17285 http://secunia.com/advisories/19130 http://secunia.com/advisories/17098 http://secunia.com/advisories/20077 http://securityreason.com/securityalert/59 XForce ISS Database: ruby-eval-security-bypass(22360) http://xforce.iss.net/xforce/xfdb/22360
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.

New User Registration Email: UserID: Passwd: Please email me your monthly newsletters, informing the latest services, improvements & surveys. Please email me a vulnerability test announcement whenever a new test is added.     Privacy

Registered User Login   UserID:     Passwd:     Forgot userid or passwd? Email/Userid: