The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site, different components than CVE-2007-5162.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2007-0965 advisory.

    [1.8.5-5.el5_1.1]
     - security fix for CVE-2007-5162 and CVE-2007-5770
     - ruby-1.8.5-CVE-2007-5162.patch: fix issues that is insufficient verification        of SSL certificate. (#320331)
     - Fix the multilib regression issue.

     [1.8.5-5]
     - security fix release.
     - ruby-1.8.5-cgi-CVE-2006-6303.patch: fix a infinite loop with certain HTTP        request. (#218290)
     -------------- next part --------------      An HTML attachment was scrubbed...
     URL: http://oss.oracle.com/pipermail/el-errata/attachments/20071123/5e0ea409/attachment.html

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

From Red Hat Security Advisory 2007:0961 :

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for object-oriented programming.

A flaw was discovered in the way Ruby's CGI module handles certain HTTP requests. If a remote attacker sends a specially crafted request, it is possible to cause the ruby CGI script to enter an infinite loop, possibly causing a denial of service. (CVE-2006-6303)

An SSL certificate validation flaw was discovered in several Ruby Net modules. The libraries were not checking the requested host name against the common name (CN) in the SSL server certificate, possibly allowing a man in the middle attack. (CVE-2007-5162, CVE-2007-5770)

Users of Ruby should upgrade to these updated packages, which contain backported patches to resolve these issues.

A flaw was discovered in the way Ruby's CGI module handles certain HTTP requests. If a remote attacker sends a specially crafted request, it is possible to cause the ruby CGI script to enter an infinite loop, possibly causing a denial of service. (CVE-2006-6303)

An SSL certificate validation flaw was discovered in several Ruby Net modules. The libraries were not checking the requested host name against the common name (CN) in the SSL server certificate, possibly allowing a man in the middle attack. (CVE-2007-5162, CVE-2007-5770)

Ruby network libraries Net::HTTP, Net::IMAP, Net::FTPTLS, Net::Telnet, Net::POP3, and Net::SMTP, up to Ruby version 1.8.6 are affected by a possible man-in-the-middle attack, when using SSL, due to a missing check of the CN (common name) attribute in SSL certificates against the server's hostname.

The updated packages have been patched to prevent the issue.

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for object-oriented programming.

A flaw was discovered in the way Ruby's CGI module handles certain HTTP requests. If a remote attacker sends a specially crafted request, it is possible to cause the ruby CGI script to enter an infinite loop, possibly causing a denial of service. (CVE-2006-6303)

An SSL certificate validation flaw was discovered in several Ruby Net modules. The libraries were not checking the requested host name against the common name (CN) in the SSL server certificate, possibly allowing a man in the middle attack. (CVE-2007-5162, CVE-2007-5770)

Users of Ruby should upgrade to these updated packages, which contain backported patches to resolve these issues.

Chris Clark discovered that Ruby's HTTPS module did not check for commonName mismatches early enough during SSL negotiation. If a remote attacker were able to perform man-in-the-middle attacks, this flaw could be exploited to view sensitive information in HTTPS requests coming from Ruby applications. (CVE-2007-5162)

It was discovered that Ruby's FTPTLS, telnets, and IMAPS modules did not check the commonName when performing SSL certificate checks. If a remote attacker were able to perform man-in-the-middle attacks, this flaw could be exploited to eavesdrop on encrypted communications from Ruby applications using these protocols. (CVE-2007-5770).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2007-009 applied. 

This update contains several security fixes for a large number of programs.

This update of ruby improves the SSL certificate verification process.
(CVE-2007-5162 / CVE-2007-5770) Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack.

This update of ruby improves the SSL certificate verification process.
(CVE-2007-5162, CVE-2007-5770) Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack.

Several vulnerabilities have been discovered in Ruby, an object-oriented scripting language. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2007-5162     It was discovered that the Ruby HTTP(S) module performs     insufficient validation of SSL certificates, which may     lead to man-in-the-middle attacks.

  - CVE-2007-5770     It was discovered that the Ruby modules for FTP, Telnet,     IMAP, POP and SMTP perform insufficient validation of     SSL certificates, which may lead to man-in-the-middle     attacks.

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for object-oriented programming.

An SSL certificate validation flaw was discovered in several Ruby Net modules. The libraries were not checking the requested host name against the common name (CN) in the SSL server certificate, possibly allowing a man in the middle attack. (CVE-2007-5162, CVE-2007-5770)

Users of Ruby should upgrade to these updated packages, which contain a backported patch to resolve these issues.

ID	Name	Product	Family	Severity
180607	Oracle Linux 5 : Moderate: / ruby (ELSA-2007-0965)	Nessus	Oracle Linux Local Security Checks	medium
67584	Oracle Linux 4 : ruby (ELSA-2007-0961)	Nessus	Oracle Linux Local Security Checks	medium
60301	Scientific Linux Security Update : ruby on SL5.x, SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
38115	Mandriva Linux Security Advisory : ruby (MDVSA-2008:029)	Nessus	Mandriva Local Security Checks	medium
37552	CentOS 4 : ruby (CESA-2007:0961)	Nessus	CentOS Local Security Checks	medium
31704	Ubuntu 6.06 LTS / 6.10 / 7.04 / 7.10 : ruby1.8 vulnerabilities (USN-596-1)	Nessus	Ubuntu Local Security Checks	medium
29723	Mac OS X Multiple Vulnerabilities (Security Update 2007-009)	Nessus	MacOS X Local Security Checks	critical
29573	SuSE 10 Security Update : ruby (ZYPP Patch Number 4702)	Nessus	SuSE Local Security Checks	medium
28328	openSUSE 10 Security Update : ruby (ruby-4703)	Nessus	SuSE Local Security Checks	medium
28301	Debian DSA-1412-1 : ruby1.9 - programming error	Nessus	Debian Local Security Checks	medium
28300	Debian DSA-1411-1 : libopenssl-ruby - programming error	Nessus	Debian Local Security Checks	medium
28299	Debian DSA-1410-1 : ruby1.8 - programming error	Nessus	Debian Local Security Checks	medium
28202	RHEL 5 : ruby (RHSA-2007:0965)	Nessus	Red Hat Local Security Checks	medium
28201	RHEL 4 : ruby (RHSA-2007:0961)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2007-5770

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium