Test ID:	1.3.6.1.4.1.25623.1.0.64961
Category:	Fedora Local Security Checks
Title:	Fedora Core 10 FEDORA-2009-9799 (rubygem-activesupport)
Summary:	The remote host is missing an update to rubygem-activesupport;announced via advisory FEDORA-2009-9799.;Note: This VT has been deprecated and is therefore no longer functional.
Description:	Summary: The remote host is missing an update to rubygem-activesupport announced via advisory FEDORA-2009-9799. Note: This VT has been deprecated and is therefore no longer functional. Vulnerability Insight: Update Information: A vulnerability is found on Ruby on Rails in the escaping code for the form helpers, which also affects the rpms shipped in Fedora Project. Attackers who can inject deliberately malformed unicode strings into the form helpers can defeat the escaping checks and inject arbitrary HTML. This issue has been tagged as CVE-2009-3009. These new rpms will fix this issue. ChangeLog: * Mon Sep 21 2009 Mamoru Tasaka - 2.1.1-2 - Patch for CVE-2009-3009 (bug 520843) Solution: Apply the appropriate updates. This update can be installed with the yum update program. Use su -c 'yum update rubygem-activesupport' at the command line. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3009 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html BugTraq ID: 36278 http://www.securityfocus.com/bid/36278 Debian Security Information: DSA-1887 (Google Search) http://www.debian.org/security/2009/dsa-1887 http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source http://www.osvdb.org/57666 http://securitytracker.com/id?1022824 http://secunia.com/advisories/36600 http://secunia.com/advisories/36717 SuSE Security Announcement: SUSE-SR:2009:017 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html http://www.vupen.com/english/advisories/2009/2544 XForce ISS Database: rubyonrails-unicode-xss(53036) https://exchange.xforce.ibmcloud.com/vulnerabilities/53036
Copyright	Copyright (C) 2009 E-Soft Inc.

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.