Scientific Linux Security Update : ruby on SL5.x, SL6.x i386/srpm/x86_64 (20130717)

medium Nessus Plugin ID 68946

Language:

Synopsis

The remote Scientific Linux host is missing one or more security updates.

Description

A flaw was found in Ruby's SSL client's hostname identity check when handling certificates that contain hostnames with NULL bytes. An attacker could potentially exploit this flaw to conduct man-in-the-middle attacks to spoof SSL servers. Note that to exploit this issue, an attacker would need to obtain a carefully-crafted certificate signed by an authority that the client trusts.
(CVE-2013-4073)

Solution

Update the affected packages.

Plugin Details

Severity: Medium

ID: 68946

File Name: sl_20130717_ruby_on_SL5_x.nasl

Version: 1.6

Type: local

Agent: unix

Family: Scientific Linux Local Security Checks

Published: 7/18/2013

Updated: 1/14/2021

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:fermilab:scientific_linux:ruby-mode, p-cpe:/a:fermilab:scientific_linux:ruby-irb, p-cpe:/a:fermilab:scientific_linux:ruby-docs, p-cpe:/a:fermilab:scientific_linux:ruby-ri, x-cpe:/o:fermilab:scientific_linux, p-cpe:/a:fermilab:scientific_linux:ruby-devel, p-cpe:/a:fermilab:scientific_linux:ruby-static, p-cpe:/a:fermilab:scientific_linux:ruby-debuginfo, p-cpe:/a:fermilab:scientific_linux:ruby-libs, p-cpe:/a:fermilab:scientific_linux:ruby, p-cpe:/a:fermilab:scientific_linux:ruby-rdoc, p-cpe:/a:fermilab:scientific_linux:ruby-tcltk

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Patch Publication Date: 7/17/2013

Vulnerability Publication Date: 8/18/2013

Reference Information

CVE: CVE-2013-4073

Detections

Analytics