Detections
Analytics
Debian DLA-88-1 : ruby1.8 security update
high Nessus Plugin ID 82233
Language:
Synopsis
The remote Debian host is missing a security update.Description
This update fixes multiple local and remote denial of service and remote code execute problems :CVE-2011-0188 Properly allocate memory, to prevent arbitrary code execution or application crash. Reported by Drew Yao.
CVE-2011-2686
Reinitialize the random seed when forking to prevent CVE-2003-0900 like situations.
CVE-2011-2705 Modify PRNG state to prevent random number sequence repeatation at forked child process which has same pid. Reported by Eric Wong.
CVE-2011-4815
Fix a problem with predictable hash collisions resulting in denial of service (CPU consumption) attacks. Reported by Alexander Klink and Julian Waelde.
CVE-2014-8080
Fix REXML parser to prevent memory consumption denial of service via crafted XML documents. Reported by Willis Vandevanter.
CVE-2014-8090
Add REXML::Document#document to complement the fix for CVE-2014-8080.
Reported by Tomas Hoger.
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Upgrade the affected packages.See Also
https://lists.debian.org/debian-lts-announce/2014/11/msg00007.html
Plugin Details
Severity: High
ID: 82233
File Name: debian_DLA-88.nasl
Version: 1.9
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 3/26/2015
Updated: 1/11/2021
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.8
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:libruby1.8, p-cpe:/a:debian:debian_linux:libruby1.8-dbg, p-cpe:/a:debian:debian_linux:libtcltk-ruby1.8, p-cpe:/a:debian:debian_linux:ri1.8, p-cpe:/a:debian:debian_linux:ruby1.8, p-cpe:/a:debian:debian_linux:ruby1.8-dev, p-cpe:/a:debian:debian_linux:ruby1.8-elisp, p-cpe:/a:debian:debian_linux:ruby1.8-examples, cpe:/o:debian:debian_linux:6.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 11/21/2014
Reference Information
CVE: CVE-2011-0188, CVE-2011-2686, CVE-2011-2705, CVE-2011-4815, CVE-2014-8080, CVE-2014-8090