The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1581 advisory.

    - Update to Ruby 1.8.7-p352.
      * Remove Patch43: ruby-1.8.7-CVE-2011-1004.patch; subsumed
      * Remove Patch44: ruby-1.8.7-CVE-2011-1005.patch; subsumed
      * Remove Patch200: ruby-1.8.7-webrick-CVE.patch; subsumed
    - Address CVE-2011-1004 'Symlink race condition by removing directory trees in       fileutils module'
      * ruby-1.8.7-CVE-2011-1004.patch
    - Address CVE-2011-1005 'Untrusted codes able to modify arbitrary strings'
      * ruby-1.8.7-CVE-2011-1005.patch
    - Address CVE-2011-0188 'memory corruption in BigDecimal on 64bit platforms'
      * ruby-1.8.7-CVE-2011-0188.patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2011-0188 The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an 'integer truncation issue.'

CVE-2011-2705 use upstream SVN r32050 to modify PRNG state to prevent random number sequence repeatation at forked child process which has same pid. Reported by Eric Wong.

CVE-2012-4522 The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path.

CVE-2013-0256 darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

CVE-2013-2065 (1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.

CVE-2015-1855 OpenSSL extension hostname matching implementation violates RFC 6125

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes multiple local and remote denial of service and remote code execute problems :

CVE-2011-0188 Properly allocate memory, to prevent arbitrary code execution or application crash. Reported by Drew Yao.

CVE-2011-2686

Reinitialize the random seed when forking to prevent CVE-2003-0900 like situations.

CVE-2011-2705 Modify PRNG state to prevent random number sequence repeatation at forked child process which has same pid. Reported by Eric Wong.

CVE-2011-4815

Fix a problem with predictable hash collisions resulting in denial of service (CPU consumption) attacks. Reported by Alexander Klink and Julian Waelde.

CVE-2014-8080

Fix REXML parser to prevent memory consumption denial of service via crafted XML documents. Reported by Willis Vandevanter.

CVE-2014-8090

Add REXML::Document#document to complement the fix for CVE-2014-8080.
Reported by Tomas Hoger.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of ruby provides 1.8.7p357, which contains many stability fixes and bug fixes, which are fully compatible with the previous version. You can review the detailed list here :

http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_357/ChangeLog

The particularly noteworthy fixes are :

  - Hash functions are now using a randomized seed to avoid     algorithmic complexity attacks (CVE-2011-4815). For this     OpenSSL::Random.seed at the SecureRandom.random_bytes is     used if available.

  - mkconfig.rb: fix for continued lines.

  - Fix Infinity to be greater than any bignum number.

  - initialize store->ex_data.sk.

  - some IPv6 related fixes

  - zlib fixes

  - reinitialize PRNG when forking children     (CVE-2011-2686/CVE-2011-3009)

  - securerandom fixes (CVE-2011-2705)

  - uri route_to fixes

  - fix race condition with variables and autoload

Drew Yao discovered that the WEBrick HTTP server was vulnerable to cross-site scripting attacks when displaying error pages. A remote attacker could use this flaw to run arbitrary web script.
(CVE-2010-0541)

Drew Yao discovered that Ruby's BigDecimal module did not properly allocate memory on 64-bit platforms. An attacker could use this flaw to cause a denial of service or possibly execute arbitrary code with user privileges. (CVE-2011-0188)

Nicholas Jefferson discovered that the FileUtils.remove_entry_secure method in Ruby did not properly remove non-empty directories. An attacker could use this flaw to possibly delete arbitrary files.
(CVE-2011-1004)

It was discovered that Ruby incorrectly allowed untainted strings to be modified in protective safe levels. An attacker could use this flaw to bypass intended access restrictions. (CVE-2011-1005)

Eric Wong discovered that Ruby does not properly reseed its pseudorandom number generator when creating child processes. An attacker could use this flaw to gain knowledge of the random numbers used in other Ruby child processes. (CVE-2011-2686)

Eric Wong discovered that the SecureRandom module in Ruby did not properly seed its pseudorandom number generator. An attacker could use this flaw to gain knowledge of the random numbers used by another Ruby process with the same process ID number. (CVE-2011-2705)

Alexander Klink and Julian Walde discovered that Ruby computed hash values without restricting the ability to trigger hash collisions predictably. A remote attacker could cause a denial of service by crafting values used in hash tables. (CVE-2011-4815).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of ruby provides 1.8.7p357, which contains many stability fixes and bug fixes while maintaining full compatibility with the previous version. A detailailed list of changes is available from http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_357/ChangeLog .

The most important fixes are :

  - Hash functions are now using a randomized seed to avoid     algorithmic complexity attacks. If available,     OpenSSL::Random.seed at the SecureRandom.random_bytes is     used to achieve this. (CVE-2011-4815)

  - mkconfig.rb: fix for continued lines.

  - Fix Infinity to be greater than any bignum number.

  - Initialize store->ex_data.sk.

  - Several IPv6 related fixes.

  - Fixes for zlib.

  - Reinitialize PRNG when forking children. (CVE-2011-2686     / CVE-2011-3009)

  - Fixes to securerandom. (CVE-2011-2705)

  - Fix uri route_to

  - Fix race condition with variables and autoload.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1581 advisory.

  - ruby: Properly initialize the random number generator when forking new process (CVE-2011-2705,     CVE-2011-3009)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

New version 1.8.7p352 is released, fixing randomization process in forked process (CVE-2011-2686). Also ruby path is fixed to have no duplicate directories on all archs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
181024	Oracle Linux 6 : ruby (ELSA-2011-1581)	Nessus	Oracle Linux Local Security Checks	high
83907	Debian DLA-235-1 : ruby1.9.1 security update	Nessus	Debian Local Security Checks	medium
82233	Debian DLA-88-1 : ruby1.8 security update	Nessus	Debian Local Security Checks	high
76015	openSUSE Security Update : ruby (openSUSE-SU-2012:0228-1)	Nessus	SuSE Local Security Checks	high
58146	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : ruby1.8 vulnerabilities (USN-1377-1)	Nessus	Ubuntu Local Security Checks	high
57841	SuSE 11.1 Security Update : ruby (SAT Patch Number 5716)	Nessus	SuSE Local Security Checks	high
57840	SuSE 11.1 Security Update : ruby (SAT Patch Number 5716)	Nessus	SuSE Local Security Checks	high
57017	RHEL 6 : ruby (RHSA-2011:1581)	Nessus	Red Hat Local Security Checks	high
55678	Fedora 14 : ruby-1.8.7.352-1.fc14 (2011-9374)	Nessus	Fedora Local Security Checks	medium
55677	Fedora 15 : ruby-1.8.7.352-1.fc15 (2011-9359)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-2705

critical

Tenable Plugins

high

medium

high

high

high

high

high

high

medium

medium