7.8 - RHSA-2008:0981

Executive Summary

Summary
Title	ruby security update

Informations
Name	RHSA-2008:0981	First vendor Publication	2008-12-04
Vendor	RedHat	Last vendor Modification	2008-12-04
Severity (Vendor)	Moderate	Revision	02

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:C)
Cvss Base Score	7.8	Attack Range	Network
Cvss Impact Score	6.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated ruby packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64 RHEL Desktop Workstation (v. 5 client) - i386, x86_64 Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Description:

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.

Vincent Danen reported, that Red Hat Security Advisory RHSA-2008:0897 did not properly address a denial of service flaw in the WEBrick (Ruby HTTP server toolkit), known as CVE-2008-365

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2008-0981.html

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-399	Resource Management Errors

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10250

Oval ID:	oval:org.mitre.oval:def:10250
Title:	httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.
Description:	httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2008-4310	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section ruby-mode is earlier than 0:1.8.1-7.el4_7.2 AND ruby-docs is earlier than 0:1.8.1-7.el4_7.2 AND ruby-devel is earlier than 0:1.8.1-7.el4_7.2 AND ruby-tcltk is earlier than 0:1.8.1-7.el4_7.2 AND ruby is earlier than 0:1.8.1-7.el4_7.2 AND irb is earlier than 0:1.8.1-7.el4_7.2 AND ruby-libs is earlier than 0:1.8.1-7.el4_7.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section ruby-ri is earlier than 0:1.8.5-5.el5_2.6 AND ruby-mode is earlier than 0:1.8.5-5.el5_2.6 AND ruby-docs is earlier than 0:1.8.5-5.el5_2.6 AND ruby-devel is earlier than 0:1.8.5-5.el5_2.6 AND ruby is earlier than 0:1.8.5-5.el5_2.6 AND ruby-libs is earlier than 0:1.8.5-5.el5_2.6 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_2.6 AND ruby-irb is earlier than 0:1.8.5-5.el5_2.6 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_2.6

Definition Id: oval:org.mitre.oval:def:22012

Oval ID:	oval:org.mitre.oval:def:22012
Title:	ELSA-2008:0981: ruby security update (Moderate)
Description:	httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656.
Family:	unix	Class:	patch
Reference(s):	ELSA-2008:0981-04 CVE-2008-4310	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	ruby
Definition Synopsis:
Oracle Linux 5.x rpm test ruby-ri is earlier than 0:1.8.5-5.el5_2.6 AND ruby-docs is earlier than 0:1.8.5-5.el5_2.6 AND ruby-mode is earlier than 0:1.8.5-5.el5_2.6 AND ruby-libs is earlier than 0:1.8.5-5.el5_2.6 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_2.6 AND ruby-irb is earlier than 0:1.8.5-5.el5_2.6 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_2.6 AND ruby is earlier than 0:1.8.5-5.el5_2.6 AND ruby-devel is earlier than 0:1.8.5-5.el5_2.6

Definition Id: oval:org.mitre.oval:def:28686

Oval ID:	oval:org.mitre.oval:def:28686
Title:	RHSA-2008:0981 -- ruby security update (Moderate)
Description:	Updated ruby packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks. Vincent Danen reported, that Red Hat Security Advisory RHSA-2008:0897 did not properly address a denial of service flaw in the WEBrick (Ruby HTTP server toolkit), known as CVE-2008-3656. This flaw allowed a remote attacker to send a specially-crafted HTTP request to a WEBrick server that would cause the server to use excessive CPU time. This update properly addresses this flaw. (CVE-2008-4310) All Ruby users should upgrade to these updated packages, which contain a correct patch that resolves this issue.
Family:	unix	Class:	patch
Reference(s):	RHSA-2008:0981 CESA-2008:0981-CentOS 5 CVE-2008-4310	Version:	3
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 4 CentOS Linux 5	Product(s):	ruby
Definition Synopsis:
Red Hat Enterprise Linux 5 and CentOS Linux 5 release section Operation system section The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages match section ruby-devel is earlier than 0:1.8.5-5.el5_2.6 AND ruby-mode is earlier than 0:1.8.5-5.el5_2.6 AND ruby is earlier than 0:1.8.5-5.el5_2.6 AND ruby-docs is earlier than 0:1.8.5-5.el5_2.6 AND ruby-irb is earlier than 0:1.8.5-5.el5_2.6 AND ruby-libs is earlier than 0:1.8.5-5.el5_2.6 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_2.6 AND ruby-ri is earlier than 0:1.8.5-5.el5_2.6 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_2.6 AND Red Hat Enterprise Linux 4 release section The operating system installed on the system is Red Hat Enterprise Linux 4 Packages match section irb is earlier than 0:1.8.1-7.el4_7.2 AND ruby is earlier than 0:1.8.1-7.el4_7.2 AND ruby-devel is earlier than 0:1.8.1-7.el4_7.2 AND ruby-docs is earlier than 0:1.8.1-7.el4_7.2 AND ruby-libs is earlier than 0:1.8.1-7.el4_7.2 AND ruby-mode is earlier than 0:1.8.1-7.el4_7.2 AND ruby-tcltk is earlier than 0:1.8.1-7.el4_7.2

CPE : Common Platform Enumeration

Type	Description	Count
Application	Ruby-Lang Ruby cpe:2.3:a:ruby-lang:ruby:1.8.5:::::::* cpe:2.3:a:ruby-lang:ruby:1.8.1:::::::*	2

OpenVAS Exploits

Date	Description
2009-03-06	Name : RedHat Update for ruby RHSA-2008:0981-02 File : nvt/gb_RHSA-2008_0981-02_ruby.nasl
2009-02-27	Name : CentOS Update for irb CESA-2008:0981 centos4 i386 File : nvt/gb_CESA-2008_0981_irb_centos4_i386.nasl
2009-02-27	Name : CentOS Update for irb CESA-2008:0981 centos4 x86_64 File : nvt/gb_CESA-2008_0981_irb_centos4_x86_64.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
47471	WEBrick in Ruby WEBrick::HTTP::DefaultFileHandler Crafted HTTP Request DoS Ruby contains a flaw that may allow a remote denial of service. The issue is triggered when WEBrick receives a specially crafted HTTP request with malformed regular expressions, and will result in loss of availability for the platform.

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0897.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2008-0981.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20081204_ruby_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2008-12-26	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0981.nasl - Type : ACT_GATHER_INFO
2008-12-05	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0981.nasl - Type : ACT_GATHER_INFO
2008-10-28	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2008-0897.nasl - Type : ACT_GATHER_INFO
2008-10-22	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2008-0897.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:52:04	Multiple Updates
2013-05-11 00:50:37	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	3
CPE ID(s)	2
osvdb(s)	1
Openvas Exploit(s)	3
Nessus® Exploit(s)	7

	Related
7.8	RHSA-2008:0897
7.8	CVE-2008-4310
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 2 more Alert(s)

7.8 - RHSA-2008:0981

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU