Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption, a different issue than CVE-2008-2663, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. This CVE description should be regarded as authoritative, although it is likely to change.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2008-0561 advisory.

    - CVE-2008-2376: Integer overflow in rb_ary_fill().
    - CVE-2008-2662: Integer overflow in rb_str_buf_append().
    - CVE-2008-2663: Integer overflow in rb_ary_store().
    - CVE-2008-2664: Unsafe use of alloca in rb_str_format().
    - CVE-2008-2725: Integer overflow in rb_ary_splice().

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Multiple integer overflows leading to a heap overflow were discovered in the array- and string-handling code used by Ruby. An attacker could use these flaws to crash a Ruby application or, possibly, execute arbitrary code with the privileges of the Ruby application using untrusted inputs in array or string operations. (CVE-2008-2376, CVE-2008-2662, CVE-2008-2663, CVE-2008-2725, CVE-2008-2726)

It was discovered that Ruby used the alloca() memory allocation function in the format (%) method of the String class without properly restricting maximum string length. An attacker could use this flaw to crash a Ruby application or, possibly, execute arbitrary code with the privileges of the Ruby application using long, untrusted strings as format strings. (CVE-2008-2664)

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Ruby is an interpreted scripting language for quick and easy object-oriented programming.

Multiple integer overflows leading to a heap overflow were discovered in the array- and string-handling code used by Ruby. An attacker could use these flaws to crash a Ruby application or, possibly, execute arbitrary code with the privileges of the Ruby application using untrusted inputs in array or string operations. (CVE-2008-2376, CVE-2008-2662, CVE-2008-2663, CVE-2008-2725, CVE-2008-2726)

It was discovered that Ruby used the alloca() memory allocation function in the format (%) method of the String class without properly restricting maximum string length. An attacker could use this flaw to crash a Ruby application or, possibly, execute arbitrary code with the privileges of the Ruby application using long, untrusted strings as format strings. (CVE-2008-2664)

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting these issues.

Users of Ruby should upgrade to these updated packages, which contain a backported patch to resolve these issues.

This update of ruby fixes :

  - a possible information leakage. (CVE-2008-1145) 

  - a directory traversal bug in WEBrick. (CVE-2008-1891) 

  - various memory corruptions and integer overflows in     array and string handling. (CVE-2008-2662,     CVE-2008-2663, CVE-2008-2664, CVE-2008-2725,     CVE-2008-2726, CVE-2008-2727, CVE-2008-2728)

This update of ruby fixes :

  - a possible information leakage (CVE-2008-1145) 

  - a directory traversal bug (CVE-2008-1891) in WEBrick 

  - various memory corruptions and integer overflows in     array and string handling (CVE-2008-2662, CVE-2008-2663,     CVE-2008-2664, CVE-2008-2725, CVE-2008-2726,     CVE-2008-2727, CVE-2008-2728)

Multiple vulnerabilities have been found in the Ruby interpreter and in Webrick, the webserver bundled with Ruby.

Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash () path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) ..%5c (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option. (CVE-2008-1145)

Directory traversal vulnerability in WEBrick in Ruby 1.9.0 and earlier, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option. (CVE-2008-1891)

Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption.
(CVE-2008-2662)

Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors.
(CVE-2008-2663)

The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca. (CVE-2008-2664)

Integer overflow in the rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allows context-dependent attackers to trigger memory corruption via unspecified vectors, aka the REALLOC_N variant.
(CVE-2008-2725)

Integer overflow in the rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption, aka the beg + rlen issue.
(CVE-2008-2726)

Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE. (CVE-2008-2376)

The updated packages have been patched to fix these issues.

Multiple vulnerabilities have been found in the Ruby interpreter and in Webrick, the webserver bundled with Ruby.

Directory traversal vulnerability in WEBrick in Ruby 1.9.0 and earlier, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option. (CVE-2008-1891)

Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption.
(CVE-2008-2662)

Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors.
(CVE-2008-2663)

The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca. (CVE-2008-2664)

Integer overflow in the rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allows context-dependent attackers to trigger memory corruption via unspecified vectors, aka the REALLOC_N variant.
(CVE-2008-2725)

Integer overflow in the rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption, aka the beg + rlen issue.
(CVE-2008-2726)

Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE. (CVE-2008-2376)

The updated packages have been patched to fix these issues.

The remote host is affected by the vulnerability described in GLSA-200812-17 (Ruby: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in the Ruby interpreter     and its standard libraries. Drew Yao of Apple Product Security     discovered the following flaws:
    Arbitrary code execution     or Denial of Service (memory corruption) in the rb_str_buf_append()     function (CVE-2008-2662).
    Arbitrary code execution or Denial     of Service (memory corruption) in the rb_ary_stor() function     (CVE-2008-2663).
    Memory corruption via alloca in the     rb_str_format() function (CVE-2008-2664).
    Memory corruption     ('REALLOC_N') in the rb_ary_splice() and rb_ary_replace() functions     (CVE-2008-2725).
    Memory corruption ('beg + rlen') in the     rb_ary_splice() and rb_ary_replace() functions (CVE-2008-2726).
    Furthermore, several other vulnerabilities have been reported:
    Tanaka Akira reported an issue with resolv.rb that enables     attackers to spoof DNS responses (CVE-2008-1447).
    Akira Tagoh     of RedHat discovered a Denial of Service (crash) issue in the     rb_ary_fill() function in array.c (CVE-2008-2376).
    Several     safe level bypass vulnerabilities were discovered and reported by Keita     Yamaguchi (CVE-2008-3655).
    Christian Neukirchen is credited     for discovering a Denial of Service (CPU consumption) attack in the     WEBRick HTTP server (CVE-2008-3656).
    A fault in the dl module     allowed the circumvention of taintness checks which could possibly lead     to insecure code execution was reported by 'sheepman'     (CVE-2008-3657).
    Tanaka Akira again found a DNS spoofing     vulnerability caused by the resolv.rb implementation using poor     randomness (CVE-2008-3905).
    Luka Treiber and Mitja Kolsek     (ACROS Security) disclosed a Denial of Service (CPU consumption)     vulnerability in the REXML module when dealing with recursive entity     expansion (CVE-2008-3790).
  Impact :

    These vulnerabilities allow remote attackers to execute arbitrary code,     spoof DNS responses, bypass Ruby's built-in security and taintness     checks, and cause a Denial of Service via crash or CPU exhaustion.
  Workaround :

    There is no known workaround at this time.

This update of ruby fixes :

  - a possible information leakage. (CVE-2008-1145)

  - a directory traversal bug (CVE-2008-1891) in WEBrick

  - various memory corruptions and integer overflows in     array and string handling. (CVE-2008-2662 /     CVE-2008-2663 / CVE-2008-2664 / CVE-2008-2725 /     CVE-2008-2726 / CVE-2008-2727 / CVE-2008-2728)

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service or the execution of arbitrary code. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-2662     Drew Yao discovered that multiple integer overflows in     the string processing code may lead to denial of service     and potentially the execution of arbitrary code.

  - CVE-2008-2663     Drew Yao discovered that multiple integer overflows in     the string processing code may lead to denial of service     and potentially the execution of arbitrary code.

  - CVE-2008-2664     Drew Yao discovered that a programming error in the     string processing code may lead to denial of service and     potentially the execution of arbitrary code.

  - CVE-2008-2725     Drew Yao discovered that an integer overflow in the     array handling code may lead to denial of service and     potentially the execution of arbitrary code.

  - CVE-2008-2726     Drew Yao discovered that an integer overflow in the     array handling code may lead to denial of service and     potentially the execution of arbitrary code.

  - CVE-2008-2376     It was discovered that an integer overflow in the array     handling code may lead to denial of service and     potentially the execution of arbitrary code.

The remote Redhat Enterprise Linux 4 / 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2008:0561 advisory.

    Ruby is an interpreted scripting language for quick and easy     object-oriented programming.

    Multiple integer overflows leading to a heap overflow were discovered in     the array- and string-handling code used by Ruby. An attacker could use     these flaws to crash a Ruby application or, possibly, execute arbitrary     code with the privileges of the Ruby application using untrusted inputs in     array or string operations. (CVE-2008-2376, CVE-2008-2662, CVE-2008-2663,     CVE-2008-2725, CVE-2008-2726)

    It was discovered that Ruby used the alloca() memory allocation function in     the format (%) method of the String class without properly restricting     maximum string length. An attacker could use this flaw to crash a Ruby     application or, possibly, execute arbitrary code with the privileges of the     Ruby application using long, untrusted strings as format strings.
    (CVE-2008-2664)

    Red Hat would like to thank Drew Yao of the Apple Product Security team for     reporting these issues.

    Users of Ruby should upgrade to these updated packages, which contain a     backported patch to resolve these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Drew Yao discovered several vulnerabilities in Ruby which lead to integer overflows. If a user or automated system were tricked into running a malicious script, an attacker could cause a denial of service or execute arbitrary code with the privileges of the user invoking the program. (CVE-2008-2662, CVE-2008-2663, CVE-2008-2725, CVE-2008-2726)

Drew Yao discovered that Ruby did not sanitize its input when using ALLOCA. If a user or automated system were tricked into running a malicious script, an attacker could cause a denial of service via memory corruption. (CVE-2008-2664).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New ruby packages are available for Slackware 11.0, 12.0, 12.1, and
-current to fix security issues.

The remote host is running a version of Mac OS X 10.4 that does not have the security update 2008-004 applied. 

This update contains security fixes for a number of programs.

The remote host is running a version of Mac OS X 10.5.x that is prior to 10.5.4. 

Mac OS X 10.5.4 contains security fixes for multiple components.

- Tue Jun 24 2008 Akira TAGOH <tagoh at redhat.com> -     1.8.6.230-1

    - New upstream release.

    - Security fixes. (#452294).

    - CVE-2008-1891: WEBrick CGI source disclosure.

    - CVE-2008-2662: Integer overflow in       rb_str_buf_append().

    - CVE-2008-2663: Integer overflow in rb_ary_store().

    - CVE-2008-2664: Unsafe use of alloca in       rb_str_format().

    - CVE-2008-2725: Integer overflow in rb_ary_splice().

    - CVE-2008-2726: Integer overflow in rb_ary_splice().

    - ruby-1.8.6.111-CVE-2007-5162.patch: removed.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Tue Jun 24 2008 Akira TAGOH <tagoh at redhat.com> -     1.8.6.230-1

    - New upstream release.

    - Security fixes. (#452293)

    - CVE-2008-1891: WEBrick CGI source disclosure.

    - CVE-2008-2662: Integer overflow in       rb_str_buf_append().

    - CVE-2008-2663: Integer overflow in rb_ary_store().

    - CVE-2008-2664: Unsafe use of alloca in       rb_str_format().

    - CVE-2008-2725: Integer overflow in rb_ary_splice().

    - CVE-2008-2726: Integer overflow in rb_ary_splice().

    - ruby-1.8.6.111-CVE-2007-5162.patch: removed.

    - Tue Mar 4 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.114-1

    - Security fix for CVE-2008-1145.

    - Improve a spec file. (#226381)

    - Correct License tag.

    - Fix a timestamp issue.

    - Own a arch-specific directory.

    - Tue Feb 19 2008 Fedora Release Engineering <rel-eng at       fedoraproject.org> - 1.8.6.111-9

    - Autorebuild for GCC 4.3

    - Tue Feb 19 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-8

    - Rebuild for gcc-4.3.

    - Tue Jan 15 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-7

    - Revert the change of libruby-static.a. (#428384)

    - Fri Jan 11 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-6

    - Fix an unnecessary replacement for shebang. (#426835)

    - Fri Jan 4 2008 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-5

    - Rebuild.

    - Fri Dec 28 2007 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-4

    - Clean up again.

    - Fri Dec 21 2007 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-3

    - Clean up the spec file.

    - Remove ruby-man-1.4.6 stuff. this is entirely the       out-dated document. this could be replaced by ri.

  - Disable the static library building.

    - Tue Dec 4 2007 Release Engineering <rel-eng at       fedoraproject dot org> - 1.8.6.111-2

    - Rebuild for openssl bump

    - Wed Oct 31 2007 Akira TAGOH <tagoh at redhat.com>

    - Fix the dead link.

    - Mon Oct 29 2007 Akira TAGOH <tagoh at redhat.com> -       1.8.6.111-1

    - New upstream release.

    - ruby-1.8.6.111-CVE-2007-5162.patch: Update a bit with       backporting the changes at trunk to enable the fix       without any modifications on the users' scripts. Note       that Net::HTTP#enable_post_connection_check isn't       available anymore. If you want to disable this       post-check, you should give OpenSSL::SSL::VERIFY_NONE       to Net::HTTP#verify_mode= instead of.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running a version of Mac OS X 10.5 that is older than version 10.5.4.  Mac OS X 10.5.4 contains security fixes for a number of programs.

ID	Name	Product	Family	Severity
67716	Oracle Linux 5 : ruby (ELSA-2008-0561)	Nessus	Oracle Linux Local Security Checks	critical
60442	Scientific Linux Security Update : ruby on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	critical
43694	CentOS 4 / 5 : ruby (CESA-2008:0561)	Nessus	CentOS Local Security Checks	critical
41228	SuSE9 Security Update : Ruby (YOU Patch Number 12214)	Nessus	SuSE Local Security Checks	critical
40121	openSUSE Security Update : ruby (ruby-123)	Nessus	SuSE Local Security Checks	critical
37401	Mandriva Linux Security Advisory : ruby (MDVSA-2008:141)	Nessus	Mandriva Local Security Checks	critical
36689	Mandriva Linux Security Advisory : ruby (MDVSA-2008:140)	Nessus	Mandriva Local Security Checks	critical
35188	GLSA-200812-17 : Ruby: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
34028	openSUSE 10 Security Update : ruby (ruby-5483)	Nessus	SuSE Local Security Checks	critical
34020	SuSE 10 Security Update : Ruby (ZYPP Patch Number 5484)	Nessus	SuSE Local Security Checks	critical
33738	Debian DSA-1618-1 : ruby1.9 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
33551	Debian DSA-1612-1 : ruby1.8 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
33495	RHEL 4 / 5 : ruby (RHSA-2008:0561)	Nessus	Red Hat Local Security Checks	critical
33390	Ubuntu 6.06 LTS / 7.04 / 7.10 / 8.04 LTS : ruby1.8 vulnerabilities (USN-621-1)	Nessus	Ubuntu Local Security Checks	critical
33287	Slackware 11.0 / 12.0 / 12.1 / current : ruby (SSA:2008-179-01)	Nessus	Slackware Local Security Checks	critical
33282	Mac OS X Multiple Vulnerabilities (Security Update 2008-004)	Nessus	MacOS X Local Security Checks	critical
33281	Mac OS X 10.5.x < 10.5.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
33261	Fedora 9 : ruby-1.8.6.230-1.fc9 (2008-5664)	Nessus	Fedora Local Security Checks	critical
33260	Fedora 8 : ruby-1.8.6.230-1.fc8 (2008-5649)	Nessus	Fedora Local Security Checks	critical
4564	Mac OS X < 10.5.4 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical

Detections

Analytics

CVE-2008-2662

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical