Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\) path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) "..%5c" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0897 advisory.

    - CVE-2008-3655: multiple insufficient safe mode restrictions.
    - CVE-2008-3656: WEBrick DoS vulnerability (CPU consumption).
    - CVE-2008-3657: missing taintness checks in dl module.
    - CVE-2008-3905: use of predictable source port and transaction id in DNS                      requests done by resolv.rb module.
    - CVE-2008-3443: Memory allocation failure in Ruby regex engine                      (remotely exploitable DoS).

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of ruby fixes :

  - a possible information leakage. (CVE-2008-1145) 

  - a directory traversal bug in WEBrick. (CVE-2008-1891) 

  - various memory corruptions and integer overflows in     array and string handling. (CVE-2008-2662,     CVE-2008-2663, CVE-2008-2664, CVE-2008-2725,     CVE-2008-2726, CVE-2008-2727, CVE-2008-2728)

This update of ruby fixes :

  - a possible information leakage (CVE-2008-1145) 

  - a directory traversal bug (CVE-2008-1891) in WEBrick 

  - various memory corruptions and integer overflows in     array and string handling (CVE-2008-2662, CVE-2008-2663,     CVE-2008-2664, CVE-2008-2725, CVE-2008-2726,     CVE-2008-2727, CVE-2008-2728)

Multiple vulnerabilities have been found in the Ruby interpreter and in Webrick, the webserver bundled with Ruby.

Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash () path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) ..%5c (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option. (CVE-2008-1145)

Directory traversal vulnerability in WEBrick in Ruby 1.9.0 and earlier, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option. (CVE-2008-1891)

Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption.
(CVE-2008-2662)

Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors.
(CVE-2008-2663)

The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca. (CVE-2008-2664)

Integer overflow in the rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allows context-dependent attackers to trigger memory corruption via unspecified vectors, aka the REALLOC_N variant.
(CVE-2008-2725)

Integer overflow in the rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption, aka the beg + rlen issue.
(CVE-2008-2726)

Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE. (CVE-2008-2376)

The updated packages have been patched to fix these issues.

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for quick and easy object-oriented programming.

The Ruby DNS resolver library, resolv.rb, used predictable transaction IDs and a fixed source port when sending DNS requests. A remote attacker could use this flaw to spoof a malicious reply to a DNS query. (CVE-2008-3905)

Ruby's XML document parsing module (REXML) was prone to a denial of service attack via XML documents with large XML entity definitions recursion. A specially crafted XML file could cause a Ruby application using the REXML module to use an excessive amount of CPU and memory.
(CVE-2008-3790)

An insufficient 'taintness' check flaw was discovered in Ruby's DL module, which provides direct access to the C language functions. An attacker could use this flaw to bypass intended safe-level restrictions by calling external C functions with the arguments from an untrusted tainted inputs. (CVE-2008-3657)

A denial of service flaw was discovered in WEBrick, Ruby's HTTP server toolkit. A remote attacker could send a specially crafted HTTP request to a WEBrick server that would cause the server to use an excessive amount of CPU time. (CVE-2008-3656)

A number of flaws were found in the safe-level restrictions in Ruby.
It was possible for an attacker to create a carefully crafted malicious script that can allow the bypass of certain safe-level restrictions. (CVE-2008-3655)

A denial of service flaw was found in Ruby's regular expression engine. If a Ruby script tried to process a large amount of data via a regular expression, it could cause Ruby to enter an infinite-loop and crash. (CVE-2008-3443)

Users of ruby should upgrade to these updated packages, which contain backported patches to resolve these issues.

This update of ruby fixes :

  - a possible information leakage. (CVE-2008-1145)

  - a directory traversal bug (CVE-2008-1891) in WEBrick

  - various memory corruptions and integer overflows in     array and string handling. (CVE-2008-2662 /     CVE-2008-2663 / CVE-2008-2664 / CVE-2008-2725 /     CVE-2008-2726 / CVE-2008-2727 / CVE-2008-2728)

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-004 applied. 

This update contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.4. 

Mac OS X 10.5.4 contains security fixes for multiple components.

- Tue Mar 4 2008 Akira TAGOH <tagoh at redhat.com> -     1.8.6.114-1

    - Security fix for CVE-2008-1145.

    - Improve a spec file. (#226381)

    - Correct License tag.

    - Fix a timestamp issue.

    - Own a arch-specific directory.

    - Tue Feb 19 2008 Fedora Release Engineering <rel-eng at       fedoraproject.org> - 1.8.6.111-9

    - Autorebuild for GCC 4.3

    - Tue Feb 19 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-8

    - Rebuild for gcc-4.3.

    - Tue Jan 15 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-7

    - Revert the change of libruby-static.a. (#428384)

    - Fri Jan 11 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-6

    - Fix an unnecessary replacement for shebang. (#426835)

    - Fri Jan 4 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-5

    - Rebuild.

    - Fri Dec 28 2007 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-4

    - Clean up again.

    - Fri Dec 21 2007 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-3

    - Clean up the spec file.

    - Remove ruby-man-1.4.6 stuff. this is entirely the       out-dated document. this could be replaced by ri.

  - Disable the static library building.

    - Tue Dec 4 2007 Release Engineering <rel-eng at       fedoraproject dot org> - 1.8.6.111-2

    - Rebuild for openssl bump

    - Wed Oct 31 2007 Akira TAGOH <tagoh at redhat.com>

    - Fix the dead link.

    - Mon Oct 29 2007 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-1

    - New upstream release.

    - ruby-1.8.6.111-CVE-2007-5162.patch: Update a bit with       backporting the changes at trunk to enable the fix       without any modifications on the users' scripts. Note       that Net::HTTP#enable_post_connection_check isn't       available anymore. If you want to disable this       post-check, you should give OpenSSL::SSL::VERIFY_NONE       to Net::HTTP#verify_mode= instead of.

  - Mon Oct 15 2007 Akira TAGOH <tagoh at redhat.com> -     1.8.6.110-2

    - Enable pthread support for ppc too. (#201452)

    - Fix unexpected dependencies appears in ruby-libs.
      (#253325)

    - Wed Oct 10 2007 Akira TAGOH <tagoh at redhat.com> -       1.8.6.110-1

    - New upstream release.

    - ruby-r12567.patch: removed.

    - ruby-1.8.6-CVE-2007-5162.patch: security fix for       Net::HTTP that is insufficient verification of SSL       certificate.

  - Thu Aug 23 2007 Akira TAGOH <tagoh at redhat.com> -     1.8.6.36-4

    - Rebuild

    - Fri Aug 10 2007 Akira TAGOH <tagoh at redhat.com>

    - Update License tag.

    - Wed Jul 25 2007 Akira TAGOH <tagoh at redhat.com> -       1.8.6.36-3

    - ruby-r12567.patch: backport patch from upstream svn to       get rid of the unnecessary declarations. (#245446)

  - Fri Jul 20 2007 Akira TAGOH <tagoh at redhat.com> -     1.8.6.36-2

    - New upstream release.

    - Fix Etc::getgrgid to get the correct gid as requested.
      (#236647)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Mar 4 2008 Akira TAGOH <tagoh at redhat.com> -     1.8.6.114-1

    - Security fix for CVE-2008-1145.

    - Improve a spec file. (#226381)

    - Correct License tag.

    - Fix a timestamp issue.

    - Own a arch-specific directory.

    - Tue Feb 19 2008 Fedora Release Engineering <rel-eng at       fedoraproject.org> - 1.8.6.111-9

    - Autorebuild for GCC 4.3

    - Tue Feb 19 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-8

    - Rebuild for gcc-4.3.

    - Tue Jan 15 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-7

    - Revert the change of libruby-static.a. (#428384)

    - Fri Jan 11 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-6

    - Fix an unnecessary replacement for shebang. (#426835)

    - Fri Jan 4 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-5

    - Rebuild.

    - Fri Dec 28 2007 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-4

    - Clean up again.

    - Fri Dec 21 2007 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-3

    - Clean up the spec file.

    - Remove ruby-man-1.4.6 stuff. this is entirely the       out-dated document. this could be replaced by ri.

  - Disable the static library building.

    - Tue Dec 4 2007 Release Engineering <rel-eng at       fedoraproject dot org> - 1.8.6.111-2

    - Rebuild for openssl bump

    - Wed Oct 31 2007 Akira TAGOH <tagoh at redhat.com>

    - Fix the dead link.

    - Mon Oct 29 2007 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-1

    - New upstream release.

    - ruby-1.8.6.111-CVE-2007-5162.patch: Update a bit with       backporting the changes at trunk to enable the fix       without any modifications on the users' scripts. Note       that Net::HTTP#enable_post_connection_check isn't       available anymore. If you want to disable this       post-check, you should give OpenSSL::SSL::VERIFY_NONE       to Net::HTTP#verify_mode= instead of.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.4.  Mac OS X 10.5.4 contains security fixes for a number of programs.

ID	Name	Product	Family	Severity
67752	Oracle Linux 5 : ruby (ELSA-2008-0897)	Nessus	Oracle Linux Local Security Checks	high
41228	SuSE9 Security Update : Ruby (YOU Patch Number 12214)	Nessus	SuSE Local Security Checks	critical
40121	openSUSE Security Update : ruby (ruby-123)	Nessus	SuSE Local Security Checks	critical
37401	Mandriva Linux Security Advisory : ruby (MDVSA-2008:141)	Nessus	Mandriva Local Security Checks	critical
34502	CentOS 4 / 5 : ruby (CESA-2008:0897)	Nessus	CentOS Local Security Checks	high
34466	RHEL 4 / 5 : ruby (RHSA-2008:0897)	Nessus	Red Hat Local Security Checks	high
34028	openSUSE 10 Security Update : ruby (ruby-5483)	Nessus	SuSE Local Security Checks	critical
34020	SuSE 10 Security Update : Ruby (ZYPP Patch Number 5484)	Nessus	SuSE Local Security Checks	critical
33282	Mac OS X Multiple Vulnerabilities (Security Update 2008-004)	Nessus	MacOS X Local Security Checks	critical
33281	Mac OS X 10.5.x < 10.5.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
31433	Fedora 7 : ruby-1.8.6.114-1.fc7 (2008-2458)	Nessus	Fedora Local Security Checks	medium
31432	Fedora 8 : ruby-1.8.6.114-1.fc8 (2008-2443)	Nessus	Fedora Local Security Checks	medium
4564	Mac OS X < 10.5.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2008-1145

high

Tenable Plugins

high

critical

critical

critical

high

high

critical

critical

critical

critical

medium

medium

critical