Detections
Analytics
Scientific Linux Security Update : ruby on SL5.x i386/x86_64 (20130108)
medium Nessus Plugin ID 63603
Language:
Synopsis
The remote Scientific Linux host is missing one or more security updates.Description
It was found that certain methods did not sanitize file names before passing them to lower layer routines in Ruby. If a Ruby application created files with names based on untrusted input, it could result in the creation of files with different names than expected.(CVE-2012-4522)
It was found that the SLSA-2011:0909 update did not correctly fix the CVE-2011-1005 issue, a flaw in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2012-4481)
This update also fixes the following bug :
- Prior to this update, the 'rb_syck_mktime' option could, under certain circumstances, terminate with a segmentation fault when installing libraries with certain gems. This update modifies the underlying code so that Ruby gems can be installed as expected.
Solution
Update the affected packages.See Also
Plugin Details
Severity: Medium
ID: 63603
File Name: sl_20130108_ruby_on_SL5_x.nasl
Version: 1.5
Type: local
Agent: unix
Published: 1/17/2013
Updated: 1/14/2021
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N
Vulnerability Information
CPE: p-cpe:/a:fermilab:scientific_linux:ruby, p-cpe:/a:fermilab:scientific_linux:ruby-debuginfo, p-cpe:/a:fermilab:scientific_linux:ruby-devel, p-cpe:/a:fermilab:scientific_linux:ruby-docs, p-cpe:/a:fermilab:scientific_linux:ruby-irb, p-cpe:/a:fermilab:scientific_linux:ruby-libs, p-cpe:/a:fermilab:scientific_linux:ruby-mode, p-cpe:/a:fermilab:scientific_linux:ruby-rdoc, p-cpe:/a:fermilab:scientific_linux:ruby-ri, p-cpe:/a:fermilab:scientific_linux:ruby-tcltk, x-cpe:/o:fermilab:scientific_linux
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu
Patch Publication Date: 1/8/2013
Vulnerability Publication Date: 3/2/2011