The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0965 advisory.

    [1.8.5-5.el5_1.1]
     - security fix for CVE-2007-5162 and CVE-2007-5770
     - ruby-1.8.5-CVE-2007-5162.patch: fix issues that is insufficient verification        of SSL certificate. (#320331)
     - Fix the multilib regression issue.

     [1.8.5-5]
     - security fix release.
     - ruby-1.8.5-cgi-CVE-2006-6303.patch: fix a infinite loop with certain HTTP        request. (#218290)
     -------------- next part --------------      An HTML attachment was scrubbed...
     URL: http://oss.oracle.com/pipermail/el-errata/attachments/20071123/5e0ea409/attachment.html

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2007:0961 :

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for object-oriented programming.

A flaw was discovered in the way Ruby's CGI module handles certain HTTP requests. If a remote attacker sends a specially crafted request, it is possible to cause the ruby CGI script to enter an infinite loop, possibly causing a denial of service. (CVE-2006-6303)

An SSL certificate validation flaw was discovered in several Ruby Net modules. The libraries were not checking the requested host name against the common name (CN) in the SSL server certificate, possibly allowing a man in the middle attack. (CVE-2007-5162, CVE-2007-5770)

Users of Ruby should upgrade to these updated packages, which contain backported patches to resolve these issues.

A flaw was discovered in the way Ruby's CGI module handles certain HTTP requests. If a remote attacker sends a specially crafted request, it is possible to cause the ruby CGI script to enter an infinite loop, possibly causing a denial of service. (CVE-2006-6303)

An SSL certificate validation flaw was discovered in several Ruby Net modules. The libraries were not checking the requested host name against the common name (CN) in the SSL server certificate, possibly allowing a man in the middle attack. (CVE-2007-5162, CVE-2007-5770)

Ruby network libraries Net::HTTP, Net::IMAP, Net::FTPTLS, Net::Telnet, Net::POP3, and Net::SMTP, up to Ruby version 1.8.6 are affected by a possible man-in-the-middle attack, when using SSL, due to a missing check of the CN (common name) attribute in SSL certificates against the server's hostname.

The updated packages have been patched to prevent the issue.

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for object-oriented programming.

A flaw was discovered in the way Ruby's CGI module handles certain HTTP requests. If a remote attacker sends a specially crafted request, it is possible to cause the ruby CGI script to enter an infinite loop, possibly causing a denial of service. (CVE-2006-6303)

An SSL certificate validation flaw was discovered in several Ruby Net modules. The libraries were not checking the requested host name against the common name (CN) in the SSL server certificate, possibly allowing a man in the middle attack. (CVE-2007-5162, CVE-2007-5770)

Users of Ruby should upgrade to these updated packages, which contain backported patches to resolve these issues.

Chris Clark discovered that Ruby's HTTPS module did not check for commonName mismatches early enough during SSL negotiation. If a remote attacker were able to perform man-in-the-middle attacks, this flaw could be exploited to view sensitive information in HTTPS requests coming from Ruby applications. (CVE-2007-5162)

It was discovered that Ruby's FTPTLS, telnets, and IMAPS modules did not check the commonName when performing SSL certificate checks. If a remote attacker were able to perform man-in-the-middle attacks, this flaw could be exploited to eavesdrop on encrypted communications from Ruby applications using these protocols. (CVE-2007-5770).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of ruby improves the SSL certificate verification process.
(CVE-2007-5162 / CVE-2007-5770) Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack.

This update of ruby improves the SSL certificate verification process.
(CVE-2007-5162, CVE-2007-5770) Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack.

Several vulnerabilities have been discovered in Ruby, an object-oriented scripting language. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-5162     It was discovered that the Ruby HTTP(S) module performs     insufficient validation of SSL certificates, which may     lead to man-in-the-middle attacks.

  - CVE-2007-5770     It was discovered that the Ruby modules for FTP, Telnet,     IMAP, POP and SMTP perform insufficient validation of     SSL certificates, which may lead to man-in-the-middle     attacks.

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for object-oriented programming.

An SSL certificate validation flaw was discovered in several Ruby Net modules. The libraries were not checking the requested host name against the common name (CN) in the SSL server certificate, possibly allowing a man in the middle attack. (CVE-2007-5162, CVE-2007-5770)

Users of Ruby should upgrade to these updated packages, which contain a backported patch to resolve these issues.

This release contains another fixes of CVE-2007-5162 for Net::FTPTLS, Net::Telnet and Net::IMAP.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Oct 4 2007 Akira TAGOH <tagoh at redhat.com> -     1.8.6.110-1

    - New upstream release.

    - ruby-r12567.patch: removed.

    - ruby-1.8.6-CVE-2007-5162.patch: security fix for       Net::HTTP that is insufficient verification of SSL       certificate. (#313791)

  - Wed Jul 25 2007 Akira TAGOH <tagoh at redhat.com> -     1.8.6.36-3

    - ruby-r12567.patch: backport patch from upstream svn to       get rid of the unnecessary declarations. (#245446)

  - Fri Jul 20 2007 Akira TAGOH <tagoh at redhat.com> -     1.8.6.36-2

    - New upstream release.

    - Fix Etc::getgrgid to get the correct gid as requested.
      (#236647)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Thu Oct 4 2007 Akira TAGOH <tagoh at redhat.com> -     1.8.5.113-1

    - New upstream release.

    - ruby-1.8.5-CVE-2007-5162.patch: security fix for       Net::HTTP that is insufficient verification of SSL       certificate. (#313801)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
180607	Oracle Linux 5 : Moderate: / ruby (ELSA-2007-0965)	Nessus	Oracle Linux Local Security Checks	medium
67584	Oracle Linux 4 : ruby (ELSA-2007-0961)	Nessus	Oracle Linux Local Security Checks	medium
60301	Scientific Linux Security Update : ruby on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
38115	Mandriva Linux Security Advisory : ruby (MDVSA-2008:029)	Nessus	Mandriva Local Security Checks	medium
37552	CentOS 4 : ruby (CESA-2007:0961)	Nessus	CentOS Local Security Checks	medium
31704	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : ruby1.8 vulnerabilities (USN-596-1)	Nessus	Ubuntu Local Security Checks	medium
29573	SuSE 10 Security Update : ruby (ZYPP Patch Number 4702)	Nessus	SuSE Local Security Checks	medium
28328	openSUSE 10 Security Update : ruby (ruby-4703)	Nessus	SuSE Local Security Checks	medium
28301	Debian DSA-1412-1 : ruby1.9 - programming error	Nessus	Debian Local Security Checks	medium
28300	Debian DSA-1411-1 : libopenssl-ruby - programming error	Nessus	Debian Local Security Checks	medium
28299	Debian DSA-1410-1 : ruby1.8 - programming error	Nessus	Debian Local Security Checks	medium
28202	RHEL 5 : ruby (RHSA-2007:0965)	Nessus	Red Hat Local Security Checks	medium
28201	RHEL 4 : ruby (RHSA-2007:0961)	Nessus	Red Hat Local Security Checks	medium
27808	Fedora 8 : ruby-1.8.6.111-1.fc8 (2007-2812)	Nessus	Fedora Local Security Checks	medium
27791	Fedora 7 : ruby-1.8.6.111-1.fc7 (2007-2685)	Nessus	Fedora Local Security Checks	medium
27772	Fedora 7 : ruby-1.8.6.110-1.fc7 (2007-2406)	Nessus	Fedora Local Security Checks	medium
26936	Fedora Core 6 : ruby-1.8.5.113-1.fc6 (2007-718)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2007-5162

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium