5 - GLSA-201609-02

Executive Summary

Summary
Title	Bundler: Insecure installation

Informations
Name	GLSA-201609-02	First vendor Publication	2016-09-26
Vendor	Gentoo	Last vendor Modification	2016-09-26
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:N)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A vulnerability has been found in Bundler, allowing injection of arbitrary code via the gem installation process.

Background

Bundler provides a consistent environment for Ruby projects by tracking and installing the exact gems and versions that are needed.

Description

Bundler, allows the installation of gems from different sources with the same names, when multiple top-level gem sources are used.

Impact

Remote attackers could inject arbitrary code via the gem install process.

Workaround

There is no known workaround at this time.

Resolution

All Bundler users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=dev-ruby/bundler-1.7.3"

References

[ 1 ] CVE-2013-0334 : http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0334

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/201609-02

Original Source

Url : http://security.gentoo.org/glsa/glsa-201609-02.xml

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-20	Improper Input Validation

CPE : Common Platform Enumeration

Type	Description	Count
Application	Bundler cpe:2.3:a:bundler:bundler:1.6.7:::::ruby:: cpe:2.3:a:bundler:bundler:1.6.6:::::ruby:: cpe:2.3:a:bundler:bundler:1.6.5:::::ruby:: cpe:2.3:a:bundler:bundler:1.6.4:::::ruby:: cpe:2.3:a:bundler:bundler:1.6.3:::::ruby:: cpe:2.3:a:bundler:bundler:1.6.2:::::ruby:: cpe:2.3:a:bundler:bundler:1.6.1:::::ruby:: cpe:2.3:a:bundler:bundler:1.6.0:::::ruby:: cpe:2.3:a:bundler:bundler:1.5.3:::::ruby:: cpe:2.3:a:bundler:bundler:1.5.2:::::ruby:: cpe:2.3:a:bundler:bundler:1.5.1:::::ruby:: cpe:2.3:a:bundler:bundler:1.5.0:::::ruby:: cpe:2.3:a:bundler:bundler:1.5.0:rc1:::::: cpe:2.3:a:bundler:bundler:1.5.0:rc2:::::: cpe:2.3:a:bundler:bundler:1.4.0:pre1:::::: cpe:2.3:a:bundler:bundler:1.4.0:rc1:::::: cpe:2.3:a:bundler:bundler:1.3.6:::::ruby:: cpe:2.3:a:bundler:bundler:1.3.5:::::ruby:: cpe:2.3:a:bundler:bundler:1.3.4:::::ruby:: cpe:2.3:a:bundler:bundler:1.3.3:::::ruby:: cpe:2.3:a:bundler:bundler:1.3.2:::::ruby:: cpe:2.3:a:bundler:bundler:1.3.1:::::ruby:: cpe:2.3:a:bundler:bundler:1.3.0:pre3:::::: cpe:2.3:a:bundler:bundler:1.3.0:pre4:::::: cpe:2.3:a:bundler:bundler:1.3.0:pre5:::::: cpe:2.3:a:bundler:bundler:1.3.0:pre6:::::: cpe:2.3:a:bundler:bundler:1.3.0:pre7:::::: cpe:2.3:a:bundler:bundler:1.3.0:::::ruby:: cpe:2.3:a:bundler:bundler:1.3.0:pre8:::::: cpe:2.3:a:bundler:bundler:1.3.0:pre2:::::: cpe:2.3:a:bundler:bundler:1.3.0:pre::::ruby::* cpe:2.3:a:bundler:bundler:1.2.5:::::ruby:: cpe:2.3:a:bundler:bundler:1.2.4:::::ruby:: cpe:2.3:a:bundler:bundler:1.2.3:::::ruby:: cpe:2.3:a:bundler:bundler:1.2.2:::::ruby:: cpe:2.3:a:bundler:bundler:1.2.1:::::ruby:: cpe:2.3:a:bundler:bundler:1.2.0:::::ruby:: cpe:2.3:a:bundler:bundler:1.2.0:rc::::ruby::* cpe:2.3:a:bundler:bundler:1.2.0:pre::::ruby::* cpe:2.3:a:bundler:bundler:1.2.0:pre1:::::: cpe:2.3:a:bundler:bundler:1.2.0:rc2:::::: cpe:2.3:a:bundler:bundler:1.1.5:::::ruby:: cpe:2.3:a:bundler:bundler:1.1.4:::::ruby:: cpe:2.3:a:bundler:bundler:1.1.3:::::ruby:: cpe:2.3:a:bundler:bundler:1.1.2:::::ruby:: cpe:2.3:a:bundler:bundler:1.1.1:::::ruby:: cpe:2.3:a:bundler:bundler:1.1.0:::::ruby:: cpe:2.3:a:bundler:bundler:1.1:pre3:::::: cpe:2.3:a:bundler:bundler:1.1:pre4:::::: cpe:2.3:a:bundler:bundler:1.1:pre5:::::: cpe:2.3:a:bundler:bundler:1.1:pre6:::::: cpe:2.3:a:bundler:bundler:1.1:pre7:::::: cpe:2.3:a:bundler:bundler:1.1:pre1:::::: cpe:2.3:a:bundler:bundler:1.1:pre8:::::: cpe:2.3:a:bundler:bundler:1.1:pre10:::::: cpe:2.3:a:bundler:bundler:1.1:rc7:::::: cpe:2.3:a:bundler:bundler:1.1:pre::::ruby::* cpe:2.3:a:bundler:bundler:1.1:rc2:::::: cpe:2.3:a:bundler:bundler:1.1:rc3:::::: cpe:2.3:a:bundler:bundler:1.1:rc4:::::: cpe:2.3:a:bundler:bundler:1.1:rc5:::::: cpe:2.3:a:bundler:bundler:1.1:pre2:::::: cpe:2.3:a:bundler:bundler:1.1:pre9:::::: cpe:2.3:a:bundler:bundler:1.1:rc::::ruby::* cpe:2.3:a:bundler:bundler:1.1:rc6:::::: cpe:2.3:a:bundler:bundler:1.1:rc8:::::: cpe:2.3:a:bundler:bundler:1.0.9:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.8:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.7:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.6:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.5:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.4:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.3:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.21:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.21:rc::::ruby::* cpe:2.3:a:bundler:bundler:1.0.20:rc::::ruby::* cpe:2.3:a:bundler:bundler:1.0.20:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.2:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.19:rc::::ruby::* cpe:2.3:a:bundler:bundler:1.0.18:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.17:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.16:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.15:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.14:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.13:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.12:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.11:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.10:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.1:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.0:rc6:::::: cpe:2.3:a:bundler:bundler:1.0.0:::::ruby:: cpe:2.3:a:bundler:bundler:1.0.0:beta6:::::: cpe:2.3:a:bundler:bundler:1.0.0:rc1:::::: cpe:2.3:a:bundler:bundler:1.0.0:rc3:::::: cpe:2.3:a:bundler:bundler:1.0.0:rc5:::::: cpe:2.3:a:bundler:bundler:1.0.0:beta7:::::: cpe:2.3:a:bundler:bundler:1.0.0:beta8:::::: cpe:2.3:a:bundler:bundler:1.0.0:beta9:::::: cpe:2.3:a:bundler:bundler:1.0.0:beta10:::::: cpe:2.3:a:bundler:bundler:1.0.0:beta1:::::: cpe:2.3:a:bundler:bundler:1.0.0:rc2:::::: cpe:2.3:a:bundler:bundler:1.0.0:rc4:::::: cpe:2.3:a:bundler:bundler::::::ruby::*	103
Os	Fedoraproject Fedora cpe:2.3:o:fedoraproject:fedora:21:::::::* cpe:2.3:o:fedoraproject:fedora:20:::::::* cpe:2.3:o:fedoraproject:fedora:19:::::::*	3
Os	Opensuse cpe:2.3:o:opensuse:opensuse:13.2:::::::* cpe:2.3:o:opensuse:opensuse:13.1:::::::*	2

Nessus® Vulnerability Scanner

Date	Description
2016-09-26	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201609-02.nasl - Type : ACT_GATHER_INFO
2015-12-22	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20151119_rubygem_bundler_and_rubygem_thor_on_SL7_x.nasl - Type : ACT_GATHER_INFO
2015-12-02	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2015-2180.nasl - Type : ACT_GATHER_INFO
2015-11-24	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2015-2180.nasl - Type : ACT_GATHER_INFO
2015-11-19	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2015-2180.nasl - Type : ACT_GATHER_INFO
2015-03-31	Name : The remote openSUSE host is missing a security update. File : openSUSE-2015-275.nasl - Type : ACT_GATHER_INFO
2014-10-12	Name : The remote Fedora host is missing a security update. File : fedora_2014-11630.nasl - Type : ACT_GATHER_INFO
2014-10-12	Name : The remote Fedora host is missing a security update. File : fedora_2014-11649.nasl - Type : ACT_GATHER_INFO
2014-10-12	Name : The remote Fedora host is missing a security update. File : fedora_2014-11677.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2016-09-27 13:24:48	Multiple Updates
2016-09-26 09:22:33	First insertion

Global Informations

Type	Count
CWE ID(s)	1
CPE ID(s)	108
Nessus® Exploit(s)	9

	Related
5	CVE-2013-0334
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 1 more Alert(s)

5 - GLSA-201609-02

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

CPE : Common Platform Enumeration

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU