Executive Summary
| Summary | |
|---|---|
| Title | ruby193-ruby security update |
| Informations | |||
|---|---|---|---|
| Name | RHSA-2014:0011 | First vendor Publication | 2014-01-07 |
| Vendor | RedHat | Last vendor Modification | 2014-01-07 |
| Severity (Vendor) | Critical | Revision | 01 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Problem Description: Updated ruby193-ruby packages that fix one security issue are now available for Red Hat OpenStack 3.0. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: OpenStack 3 - noarch, x86_64 3. Description: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. A buffer overflow flaw was found in the way Ruby parsed floating point numbers from their text representation. If an application using Ruby accepted untrusted input strings and converted them to floating point numbers, an attacker able to provide such input could cause the application to crash or, possibly, execute arbitrary code with the privileges of the application. (CVE-2013-4164) Users of Red Hat OpenStack 3.0 are advised to upgrade to these updated packages, which correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1033460 - CVE-2013-4164 ruby: heap overflow in floating point parsing |
Original Source
| Url : https://rhn.redhat.com/errata/RHSA-2014-0011.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:19789 | |||
| Oval ID: | oval:org.mitre.oval:def:19789 | ||
| Title: | DSA-2810-1 ruby1.9.1 - heap overflow | ||
| Description: | Charlie Somerville discovered that Ruby incorrectly handled floating point number conversion. If an application using Ruby accepted untrusted input strings and converted them to floating point numbers, an attacker able to provide such input could cause the application to crash or, possibly, execute arbitrary code with the privileges of the application. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2810-1 CVE-2013-4164 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7 | Product(s): | ruby1.9.1 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:19939 | |||
| Oval ID: | oval:org.mitre.oval:def:19939 | ||
| Title: | DSA-2809-1 ruby1.8 - several | ||
| Description: | Several vulnerabilities have been discovered in the interpreter for the Ruby language. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2809-1 CVE-2013-1821 CVE-2013-4073 CVE-2013-4164 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7 | Product(s): | ruby1.8 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21247 | |||
| Oval ID: | oval:org.mitre.oval:def:21247 | ||
| Title: | RHSA-2013:1764: ruby security update (Critical) | ||
| Description: | Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2013:1764-00 CESA-2013:1764 CVE-2013-4164 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | ruby |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:24019 | |||
| Oval ID: | oval:org.mitre.oval:def:24019 | ||
| Title: | ELSA-2013:1764: ruby security update (Critical) | ||
| Description: | Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2013:1764-00 CVE-2013-4164 | Version: | 6 |
| Platform(s): | Oracle Linux 6 | Product(s): | ruby |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26963 | |||
| Oval ID: | oval:org.mitre.oval:def:26963 | ||
| Title: | DEPRECATED: ELSA-2013-1764 -- ruby security update (critical) | ||
| Description: | [1.8.7.352-13] - Workaround build issues against OpenSSL with enabled ECC curves. - Make DRb compatible with OpenSSL 1.0.1. * ruby-1.9.3-p222-generate-1024-bits-RSA-key-instead-of-512-bits.patch - Fix CVE-2013-4164 Heap Overflow in Floating Point Parsing * ruby-1.9.3-p484-CVE-2013-4164-ignore-too-long-fraction-part-which-does-not-affect-the-result.patch - Resolves: rhbz#1033500 | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2013-1764 CVE-2013-4164 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | ruby |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_ruby_20140731.nasl - Type : ACT_GATHER_INFO |
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_ruby_20140114.nasl - Type : ACT_GATHER_INFO |
| 2014-12-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-27.nasl - Type : ACT_GATHER_INFO |
| 2014-11-12 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-1764.nasl - Type : ACT_GATHER_INFO |
| 2014-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-1767.nasl - Type : ACT_GATHER_INFO |
| 2014-10-21 | Name : The remote host is missing a security update for OS X Server. File : macosx_server_4_0.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-943.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-940.nasl - Type : ACT_GATHER_INFO |
| 2014-05-21 | Name : The remote host is missing a security update for OS X Server. File : macosx_server_3_1_2.nasl - Type : ACT_GATHER_INFO |
| 2014-04-22 | Name : The remote host is missing a Mac OS X update that fixes multiple security iss... File : macosx_SecUpd2014-002.nasl - Type : ACT_GATHER_INFO |
| 2014-03-21 | Name : A web application on the remote host is affected by multiple vulnerabilities. File : puppet_enterprise_311.nasl - Type : ACT_GATHER_INFO |
| 2013-12-17 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2013-350-06.nasl - Type : ACT_GATHER_INFO |
| 2013-12-14 | Name : The remote Fedora host is missing a security update. File : fedora_2013-22393.nasl - Type : ACT_GATHER_INFO |
| 2013-12-11 | Name : The remote Fedora host is missing a security update. File : fedora_2013-22315.nasl - Type : ACT_GATHER_INFO |
| 2013-12-05 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_ruby-131125.nasl - Type : ACT_GATHER_INFO |
| 2013-12-05 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2810.nasl - Type : ACT_GATHER_INFO |
| 2013-12-05 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2809.nasl - Type : ACT_GATHER_INFO |
| 2013-12-04 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20131125_ruby_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2013-12-04 | Name : The remote Fedora host is missing a security update. File : fedora_2013-22423.nasl - Type : ACT_GATHER_INFO |
| 2013-11-29 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2035-1.nasl - Type : ACT_GATHER_INFO |
| 2013-11-29 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-1764.nasl - Type : ACT_GATHER_INFO |
| 2013-11-27 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-286.nasl - Type : ACT_GATHER_INFO |
| 2013-11-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-1764.nasl - Type : ACT_GATHER_INFO |
| 2013-11-26 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2013-248.nasl - Type : ACT_GATHER_INFO |
| 2013-11-26 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2013-247.nasl - Type : ACT_GATHER_INFO |
| 2013-11-25 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_cc9043cf7f7a426eb2cc8d1980618113.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-01-07 21:19:48 |
|
