| Description: | Description:
The remote host is missing an update to ruby1.8
announced via advisory USN-621-1.
A security issue affects the following Ubuntu releases:
Ubuntu 6.06 LTS
Ubuntu 7.04
Ubuntu 7.10
Ubuntu 8.04 LTS
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
Details follow:
Drew Yao discovered several vulnerabilities in Ruby which lead to integer
overflows. If a user or automated system were tricked into running a
malicious script, an attacker could cause a denial of service or execute
arbitrary code with the privileges of the user invoking the program.
(CVE-2008-2662, CVE-2008-2663, CVE-2008-2725, CVE-2008-2726)
Drew Yao discovered that Ruby did not sanitize its input when using ALLOCA.
If a user or automated system were tricked into running a malicious script,
an attacker could cause a denial of service via memory corruption.
(CVE-2008-2664)
Solution:
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 6.06 LTS:
libruby1.8 1.8.4-1ubuntu1.5
ruby1.8 1.8.4-1ubuntu1.5
Ubuntu 7.04:
libruby1.8 1.8.5-4ubuntu2.2
ruby1.8 1.8.5-4ubuntu2.2
Ubuntu 7.10:
libruby1.8 1.8.6.36-1ubuntu3.2
ruby1.8 1.8.6.36-1ubuntu3.2
Ubuntu 8.04 LTS:
libruby1.8 1.8.6.111-2ubuntu1.1
ruby1.8 1.8.6.111-2ubuntu1.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
http://www.securityspace.com/smysecure/catid.html?in=USN-621-1
Risk factor : Critical
CVSS Score:
10.0
|
