5 - CVE-2009-1904

Executive Summary

This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.

Informations
Name	CVE-2009-1904	First vendor Publication	2009-06-11
Vendor	Cve	Last vendor Modification	2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:N/A:P)
Cvss Base Score	5	Attack Range	Network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	10	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1904

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-189	Numeric Errors (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:13411

Oval ID:	oval:org.mitre.oval:def:13411
Title:	USN-805-1 -- ruby1.8, ruby1.9 vulnerabilities
Description:	It was discovered that Ruby did not properly validate certificates. An attacker could exploit this and present invalid or revoked X.509 certificates. It was discovered that Ruby did not properly handle string arguments that represent large numbers. An attacker could exploit this and cause a denial of service
Family:	unix	Class:	patch
Reference(s):	USN-805-1 CVE-2009-0642 CVE-2009-1904	Version:	5
Platform(s):	Ubuntu 8.04 Ubuntu 9.04 Ubuntu 6.06 Ubuntu 8.10	Product(s):	ruby1.8 ruby1.9
Definition Synopsis:
Release section Ubuntu 8.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND ri1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND ruby1.8-elisp DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND ruby1.8-examples DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND irb1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libdbm-ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND ruby1.8-dev DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libreadline-ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libruby1.8-dbg DPKG is earlier than 1.8.6.111-2ubuntu1.3 AND libruby1.8 DPKG is earlier than 1.8.6.111-2ubuntu1.3 OR Release section Ubuntu 9.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND rdoc1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ri1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ri1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND ruby1.8-examples DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND ruby1.9-elisp DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ruby1.9-examples DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ruby1.8-elisp DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND irb1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND irb1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libreadline-ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND ruby1.9-dev DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND ruby1.8-dev DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libruby1.9-dbg DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 AND libruby1.8-dbg DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libruby1.8 DPKG is earlier than 1.8.7.72-3ubuntu0.1 AND libruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.1 OR Release section Ubuntu 6.06 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND ri1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND ruby1.8-elisp DPKG is earlier than 1.8.4-1ubuntu1.7 AND ruby1.8-examples DPKG is earlier than 1.8.4-1ubuntu1.7 AND irb1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 OR Architecture depended section Supported architectures section Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is i386 AND Packages section libreadline-ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND libdbm-ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND ruby1.8-dev DPKG is earlier than 1.8.4-1ubuntu1.7 AND ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 AND libruby1.8-dbg DPKG is earlier than 1.8.4-1ubuntu1.7 AND libruby1.8 DPKG is earlier than 1.8.4-1ubuntu1.7 OR Release section Ubuntu 8.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND rdoc1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ri1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ri1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND ruby1.8-examples DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND ruby1.9-elisp DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ruby1.9-examples DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ruby1.8-elisp DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND irb1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND irb1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section libreadline-ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libdbm-ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND ruby1.9-dev DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND ruby1.8-dev DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libruby1.9-dbg DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2 AND libruby1.8-dbg DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libruby1.8 DPKG is earlier than 1.8.7.72-1ubuntu0.2 AND libruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.2

Definition Id: oval:org.mitre.oval:def:13540

Oval ID:	oval:org.mitre.oval:def:13540
Title:	DSA-1860-1 ruby1.8, ruby1.9 -- several
Description:	Several vulnerabilities have been discovered in Ruby. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-0642 The return value from the OCSP_basic_verify function was not checked properly, allowing continued use of a revoked certificate. CVE-2009-1904 An issue in parsing BigDecimal numbers can result in a denial-of-service condition. The following matrix identifies fixed versions: ruby1.8 ruby1.9 oldstable 1.8.5-4etch5 1.9.0+20060609-1etch5 stable 1.8.7.72-3lenny1 1.9.0.2-9lenny1 unstable 1.8.7.173-1 We recommend that you upgrade your Ruby packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1860-1 CVE-2009-0642 CVE-2009-1904	Version:	5
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	ruby1.8 ruby1.9
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND rdoc1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND ri1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND ri1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND ruby1.8-examples DPKG is earlier than 1.8.7.72-3lenny1 AND ruby1.9-elisp DPKG is earlier than 1.9.0.2-9lenny1 AND ruby1.9-examples DPKG is earlier than 1.9.0.2-9lenny1 AND ruby1.8-elisp DPKG is earlier than 1.8.7.72-3lenny1 AND irb1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND irb1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND libreadline-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND ruby1.9-dev DPKG is earlier than 1.9.0.2-9lenny1 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND ruby1.8-dev DPKG is earlier than 1.8.7.72-3lenny1 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND libruby1.9-dbg DPKG is earlier than 1.9.0.2-9lenny1 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 AND libruby1.8-dbg DPKG is earlier than 1.8.7.72-3lenny1 AND libruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libruby1.9 DPKG is earlier than 1.9.0.2-9lenny1 OR Architecture depended section Installed architecture is hppa AND Packages section ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libreadline-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.7.72-3lenny1 AND libruby1.8-dbg DPKG is earlier than 1.8.7.72-3lenny1 AND ruby1.8-dev DPKG is earlier than 1.8.7.72-3lenny1 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 DPKG is earlier than 1.8.5-4etch5 AND rdoc1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND ri1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND ri1.8 DPKG is earlier than 1.8.5-4etch5 AND ruby1.8-examples DPKG is earlier than 1.8.5-4etch5 AND ruby1.9-elisp DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.9-examples DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.8-elisp DPKG is earlier than 1.8.5-4etch5 AND irb1.8 DPKG is earlier than 1.8.5-4etch5 AND irb1.9 DPKG is earlier than 1.9.0+20060609-1etch5 OR Architecture depended section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Packages section ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libdbm-ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND ruby1.8-dev DPKG is earlier than 1.8.5-4etch5 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libreadline-ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.9-dev DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libruby1.9-dbg DPKG is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libtcltk-ruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libruby1.8-dbg DPKG is earlier than 1.8.5-4etch5 AND libruby1.8 DPKG is earlier than 1.8.5-4etch5 AND libruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 OR Architecture depended section Installed architecture is hppa AND Packages section libreadline-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libruby1.9-dbg DPKG is earlier than 1.9.0+20060609-1etch5 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5 AND ruby1.9-dev DPKG is earlier than 1.9.0+20060609-1etch5 AND libruby1.9 DPKG is earlier than 1.9.0+20060609-1etch5

Definition Id: oval:org.mitre.oval:def:13671

Oval ID:	oval:org.mitre.oval:def:13671
Title:	USN-900-1 -- ruby1.9 vulnerabilities
Description:	Emmanouel Kellinis discovered that Ruby did not properly handle certain string operations. An attacker could exploit this issue and possibly execute arbitrary code with application privileges. Giovanni Pellerano, Alessandro Tanasi, and Francesco Ongaro discovered that Ruby did not properly sanitize data written to log files. An attacker could insert specially-crafted data into log files which could affect certain terminal emulators and cause arbitrary files to be overwritten, or even possibly execute arbitrary commands. It was discovered that Ruby did not properly handle string arguments that represent large numbers. An attacker could exploit this and cause a denial of service. This issue only affected Ubuntu 9.10
Family:	unix	Class:	patch
Reference(s):	USN-900-1 CVE-2009-4124 CVE-2009-4492 CVE-2009-1904	Version:	5
Platform(s):	Ubuntu 8.10 Ubuntu 9.10 Ubuntu 9.04	Product(s):	ruby1.9
Definition Synopsis:
Release section Ubuntu 8.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section rdoc1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND ri1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND ruby1.9-elisp DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND ruby1.9-examples DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND irb1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND ruby1.9-dev DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libruby1.9-dbg DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 AND libruby1.9 DPKG is earlier than 1.9.0.2-7ubuntu1.3 OR Release section Ubuntu 9.10 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section rdoc1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND ri1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND ruby1.9-elisp DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND ruby1.9-examples DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND irb1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND ruby1.9-dev DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libruby1.9-dbg DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 AND libruby1.9 DPKG is earlier than 1.9.0.5-1ubuntu1.2 OR Release section Ubuntu 9.04 is installed AND Architecture section Architecture independet section Installed architecture is all AND Packages section rdoc1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND ri1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND ruby1.9-elisp DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND ruby1.9-examples DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND irb1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND ruby1.9-dev DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libopenssl-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libreadline-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libruby1.9-dbg DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libtcltk-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libgdbm-ruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2 AND libruby1.9 DPKG is earlier than 1.9.0.2-9ubuntu1.2

Definition Id: oval:org.mitre.oval:def:22900

Oval ID:	oval:org.mitre.oval:def:22900
Title:	ELSA-2009:1140: ruby security update (Moderate)
Description:	The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
Family:	unix	Class:	patch
Reference(s):	ELSA-2009:1140-02 CVE-2007-1558 CVE-2009-0642 CVE-2009-1904	Version:	17
Platform(s):	Oracle Linux 5	Product(s):	ruby
Definition Synopsis:
Oracle Linux 5.x rpm test ruby-ri is earlier than 0:1.8.5-5.el5_3.7 AND ruby-docs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-mode is earlier than 0:1.8.5-5.el5_3.7 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_3.7 AND ruby-libs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-irb is earlier than 0:1.8.5-5.el5_3.7 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_3.7 AND ruby is earlier than 0:1.8.5-5.el5_3.7 AND ruby-devel is earlier than 0:1.8.5-5.el5_3.7

Definition Id: oval:org.mitre.oval:def:29258

Oval ID:	oval:org.mitre.oval:def:29258
Title:	RHSA-2009:1140 -- ruby security update (Moderate)
Description:	Updated ruby packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.
Family:	unix	Class:	patch
Reference(s):	RHSA-2009:1140 CESA-2009:1140-CentOS 5 CVE-2007-1558 CVE-2009-0642 CVE-2009-1904	Version:	3
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 4 CentOS Linux 5	Product(s):	ruby
Definition Synopsis:
Red Hat Enterprise Linux 5 and CentOS Linux 5 release section Operation system section The operating system installed on the system is Red Hat Enterprise Linux 5 AND The operating system installed on the system is CentOS Linux 5.x Packages match section ruby-devel is earlier than 0:1.8.5-5.el5_3.7 AND ruby-mode is earlier than 0:1.8.5-5.el5_3.7 AND ruby is earlier than 0:1.8.5-5.el5_3.7 AND ruby-docs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-irb is earlier than 0:1.8.5-5.el5_3.7 AND ruby-libs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_3.7 AND ruby-ri is earlier than 0:1.8.5-5.el5_3.7 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_3.7 AND Red Hat Enterprise Linux 4 release section The operating system installed on the system is Red Hat Enterprise Linux 4 Packages match section irb is earlier than 0:1.8.1-7.el4_8.3 AND ruby is earlier than 0:1.8.1-7.el4_8.3 AND ruby-devel is earlier than 0:1.8.1-7.el4_8.3 AND ruby-docs is earlier than 0:1.8.1-7.el4_8.3 AND ruby-libs is earlier than 0:1.8.1-7.el4_8.3 AND ruby-mode is earlier than 0:1.8.1-7.el4_8.3 AND ruby-tcltk is earlier than 0:1.8.1-7.el4_8.3

Definition Id: oval:org.mitre.oval:def:7853

Oval ID:	oval:org.mitre.oval:def:7853
Title:	DSA-1860 ruby1.8, ruby1.9 -- several vulnerabilities
Description:	Several vulnerabilities have been discovered in Ruby. The Common Vulnerabilities and Exposures project identifies the following problems: The return value from the OCSP_basic_verify function was not checked properly, allowing continued use of a revoked certificate. An issue in parsing BigDecimal numbers can result in a denial-of-service condition (crash). The following matrix identifies fixed versions: We recommend that you upgrade your Ruby packages.
Family:	unix	Class:	patch
Reference(s):	DSA-1860 CVE-2009-0642 CVE-2009-1904	Version:	3
Platform(s):	Debian GNU/Linux 5.0 Debian GNU/Linux 4.0	Product(s):	ruby1.8 ruby1.9
Definition Synopsis:
Release section Debian GNU/Linux 5.0 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 is earlier than 1.8.7.72-3lenny1 AND rdoc1.9 is earlier than 1.9.0.2-9lenny1 AND ri1.9 is earlier than 1.9.0.2-9lenny1 AND ri1.8 is earlier than 1.8.7.72-3lenny1 AND ruby1.8-examples is earlier than 1.8.7.72-3lenny1 AND ruby1.9-examples is earlier than 1.9.0.2-9lenny1 AND ruby1.8-elisp is earlier than 1.8.7.72-3lenny1 AND ruby1.9-elisp is earlier than 1.9.0.2-9lenny1 AND irb1.8 is earlier than 1.8.7.72-3lenny1 AND irb1.9 is earlier than 1.9.0.2-9lenny1 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is armel AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Packages section ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libdbm-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND ruby1.9-dev is earlier than 1.9.0.2-9lenny1 AND libopenssl-ruby1.9 is earlier than 1.9.0.2-9lenny1 AND libopenssl-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND ruby1.8-dev is earlier than 1.8.7.72-3lenny1 AND libtcltk-ruby1.9 is earlier than 1.9.0.2-9lenny1 AND libreadline-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libreadline-ruby1.9 is earlier than 1.9.0.2-9lenny1 AND ruby1.9 is earlier than 1.9.0.2-9lenny1 AND libruby1.9-dbg is earlier than 1.9.0.2-9lenny1 AND libtcltk-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.9 is earlier than 1.9.0.2-9lenny1 AND libdbm-ruby1.9 is earlier than 1.9.0.2-9lenny1 AND libruby1.8-dbg is earlier than 1.8.7.72-3lenny1 AND libruby1.8 is earlier than 1.8.7.72-3lenny1 AND libruby1.9 is earlier than 1.9.0.2-9lenny1 OR Architecture dependent section Installed architecture is hppa AND Packages section libreadline-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libdbm-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libopenssl-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND ruby1.8-dev is earlier than 1.8.7.72-3lenny1 AND ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libgdbm-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libtcltk-ruby1.8 is earlier than 1.8.7.72-3lenny1 AND libruby1.8-dbg is earlier than 1.8.7.72-3lenny1 AND libruby1.8 is earlier than 1.8.7.72-3lenny1 OR Release section Debian GNU/Linux 4.0 is installed. AND Architecture section Architecture independent section Installed architecture is all AND Packages section rdoc1.8 is earlier than 1.8.5-4etch5 AND rdoc1.9 is earlier than 1.9.0+20060609-1etch5 AND ri1.9 is earlier than 1.9.0+20060609-1etch5 AND ri1.8 is earlier than 1.8.5-4etch5 AND ruby1.8-examples is earlier than 1.8.5-4etch5 AND ruby1.9-examples is earlier than 1.9.0+20060609-1etch5 AND ruby1.8-elisp is earlier than 1.8.5-4etch5 AND ruby1.9-elisp is earlier than 1.9.0+20060609-1etch5 AND irb1.8 is earlier than 1.8.5-4etch5 AND irb1.9 is earlier than 1.9.0+20060609-1etch5 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is powerpc AND Installed architecture is mipsel AND Packages section ruby1.8 is earlier than 1.8.5-4etch5 AND libdbm-ruby1.8 is earlier than 1.8.5-4etch5 AND libdbm-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.8 is earlier than 1.8.5-4etch5 AND ruby1.8-dev is earlier than 1.8.5-4etch5 AND libtcltk-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libreadline-ruby1.8 is earlier than 1.8.5-4etch5 AND libreadline-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND ruby1.9-dev is earlier than 1.9.0+20060609-1etch5 AND ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libruby1.9-dbg is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.8 is earlier than 1.8.5-4etch5 AND libtcltk-ruby1.8 is earlier than 1.8.5-4etch5 AND libruby1.8-dbg is earlier than 1.8.5-4etch5 AND libruby1.8 is earlier than 1.8.5-4etch5 AND libruby1.9 is earlier than 1.9.0+20060609-1etch5 OR Architecture dependent section Installed architecture is hppa AND Packages section ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libdbm-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libopenssl-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND ruby1.9-dev is earlier than 1.9.0+20060609-1etch5 AND libreadline-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libruby1.9-dbg is earlier than 1.9.0+20060609-1etch5 AND libtcltk-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libgdbm-ruby1.9 is earlier than 1.9.0+20060609-1etch5 AND libruby1.9 is earlier than 1.9.0+20060609-1etch5

Definition Id: oval:org.mitre.oval:def:9780

Oval ID:	oval:org.mitre.oval:def:9780
Title:	The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
Description:	The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-1904	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section ruby-mode is earlier than 0:1.8.1-7.el4_8.3 AND ruby-docs is earlier than 0:1.8.1-7.el4_8.3 AND ruby-devel is earlier than 0:1.8.1-7.el4_8.3 AND ruby-tcltk is earlier than 0:1.8.1-7.el4_8.3 AND ruby is earlier than 0:1.8.1-7.el4_8.3 AND irb is earlier than 0:1.8.1-7.el4_8.3 AND ruby-libs is earlier than 0:1.8.1-7.el4_8.3 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section ruby-ri is earlier than 0:1.8.5-5.el5_3.7 AND ruby-mode is earlier than 0:1.8.5-5.el5_3.7 AND ruby-docs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-devel is earlier than 0:1.8.5-5.el5_3.7 AND ruby is earlier than 0:1.8.5-5.el5_3.7 AND ruby-libs is earlier than 0:1.8.5-5.el5_3.7 AND ruby-tcltk is earlier than 0:1.8.5-5.el5_3.7 AND ruby-irb is earlier than 0:1.8.5-5.el5_3.7 AND ruby-rdoc is earlier than 0:1.8.5-5.el5_3.7

CPE : Common Platform Enumeration

Type	Description	Count
Application	Ruby-Lang Ruby cpe:2.3:a:ruby-lang:ruby:1.8.7:::::::* cpe:2.3:a:ruby-lang:ruby:1.8.6:::::::*	2

OpenVAS Exploits

Date	Description
2011-08-09	Name : CentOS Update for ruby CESA-2009:1140 centos5 i386 File : nvt/gb_CESA-2009_1140_ruby_centos5_i386.nasl
2010-05-12	Name : Mac OS X 10.6.3 Update / Mac OS X Security Update 2010-002 File : nvt/macosx_upd_10_6_3_secupd_2010-002.nasl
2010-03-02	Name : Fedora Update for ruby FEDORA-2010-0533 File : nvt/gb_fedora_2010_0533_ruby_fc11.nasl
2010-02-19	Name : Ubuntu Update for ruby1.9 vulnerabilities USN-900-1 File : nvt/gb_ubuntu_USN_900_1.nasl
2009-12-14	Name : Fedora Core 10 FEDORA-2009-13066 (ruby) File : nvt/fcore_2009_13066.nasl
2009-12-10	Name : Mandriva Security Advisory MDVSA-2009:325 (ruby) File : nvt/mdksa_2009_325.nasl
2009-10-11	Name : SLES11: Security update for ruby File : nvt/sles11_ruby.nasl
2009-10-10	Name : SLES9: Security update for ruby File : nvt/sles9p5053737.nasl
2009-08-17	Name : Debian Security Advisory DSA 1860-1 (ruby1.8, ruby1.9) File : nvt/deb_1860_1.nasl
2009-08-17	Name : Mandrake Security Advisory MDVSA-2009:177 (ruby) File : nvt/mdksa_2009_177.nasl
2009-07-29	Name : Mandrake Security Advisory MDVSA-2009:160 (ruby) File : nvt/mdksa_2009_160.nasl
2009-07-29	Name : SuSE Security Advisory SUSE-SA:2009:037 (dhcp-client) File : nvt/suse_sa_2009_037.nasl
2009-07-29	Name : Ubuntu USN-805-1 (ruby1.9) File : nvt/ubuntu_805_1.nasl
2009-07-06	Name : CentOS Security Advisory CESA-2009:1140 (ruby) File : nvt/ovcesa2009_1140.nasl
2009-07-06	Name : RedHat Security Advisory RHSA-2009:1140 File : nvt/RHSA_2009_1140.nasl
2009-06-30	Name : Gentoo Security Advisory GLSA 200906-02 (ruby) File : nvt/glsa_200906_02.nasl
2009-06-23	Name : Ruby BigDecimal Library Denial of Service Vulnerability (Linux) File : nvt/secpod_ruby_bigdecimal_lib_dos_vuln.nasl
2009-06-15	Name : FreeBSD Ports: ruby, ruby+pthreads, ruby+pthreads+oniguruma, ruby+oniguruma File : nvt/freebsd_ruby10.nasl
0000-00-00	Name : Slackware Advisory SSA:2009-170-02 ruby File : nvt/esoft_slk_ssa_2009_170_02.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
55031	Ruby BigDecimal Library Float Data Type Conversion String Argument Handling DoS

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-1140.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090702_ruby_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2011-01-27	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_ruby-6338.nasl - Type : ACT_GATHER_INFO
2010-03-29	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_SecUpd2010-002.nasl - Type : ACT_GATHER_INFO
2010-03-29	Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_6_3.nasl - Type : ACT_GATHER_INFO
2010-02-24	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1860.nasl - Type : ACT_GATHER_INFO
2010-02-17	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-900-1.nasl - Type : ACT_GATHER_INFO
2010-01-06	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-1140.nasl - Type : ACT_GATHER_INFO
2009-12-14	Name : The remote Fedora host is missing a security update. File : fedora_2009-13066.nasl - Type : ACT_GATHER_INFO
2009-12-08	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-325.nasl - Type : ACT_GATHER_INFO
2009-10-06	Name : The remote openSUSE host is missing a security update. File : suse_ruby-6339.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_12452.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_ruby-090703.nasl - Type : ACT_GATHER_INFO
2009-07-28	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-160.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_ruby-090703.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_1_ruby-090703.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-805-1.nasl - Type : ACT_GATHER_INFO
2009-07-03	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-1140.nasl - Type : ACT_GATHER_INFO
2009-06-29	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200906-02.nasl - Type : ACT_GATHER_INFO
2009-06-21	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2009-170-02.nasl - Type : ACT_GATHER_INFO
2009-06-15	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_62e0fbe5579811debb78001cc0377035.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=532689
http://bugs.gentoo.org/show_bug.cgi?id=273213
http://github.com/NZKoz/bigdecimal-segfault-fix/tree/master
http://groups.google.com/group/rubyonrails-security/msg/fad60751e2b9b4f6?dmod...
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://mail-index.netbsd.org/pkgsrc-changes/2009/06/10/msg024708.html
http://osvdb.org/55031
http://redmine.ruby-lang.org/issues/show/794
http://secunia.com/advisories/35399
http://secunia.com/advisories/35527
http://secunia.com/advisories/35593
http://secunia.com/advisories/35699
http://secunia.com/advisories/35937
http://secunia.com/advisories/37705
http://security.gentoo.org/glsa/glsa-200906-02.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2009&...
http://support.apple.com/kb/HT4077
http://weblog.rubyonrails.org/2009/6/10/dos-vulnerability-in-ruby/
http://www.mandriva.com/security/advisories?name=MDVSA-2009:160
http://www.redhat.com/support/errata/RHSA-2009-1140.html
http://www.ruby-forum.com/topic/189071
http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/
http://www.securityfocus.com/bid/35278
http://www.securitytracker.com/id?1022371
http://www.ubuntu.com/usn/USN-805-1
http://www.vupen.com/english/advisories/2009/1563
https://bugs.launchpad.net/bugs/385436
https://bugs.launchpad.net/bugs/cve/2009-1904
https://exchange.xforce.ibmcloud.com/vulnerabilities/51032
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
https://www.redhat.com/archives/fedora-package-announce/2009-December/msg0073...

Source	Url

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-11-28 23:11:06	Multiple Updates
2024-11-28 12:19:08	Multiple Updates
2021-05-04 12:09:39	Multiple Updates
2021-04-22 01:10:00	Multiple Updates
2020-05-23 00:23:52	Multiple Updates
2017-09-29 09:24:15	Multiple Updates
2017-08-17 09:22:36	Multiple Updates
2016-06-28 17:43:10	Multiple Updates
2016-04-26 18:52:21	Multiple Updates
2014-02-17 10:50:20	Multiple Updates
2013-05-10 23:51:47	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	7
CPE ID(s)	2
Sources(s)	31
osvdb(s)	1
Openvas Exploit(s)	19
Nessus® Exploit(s)	21

	Related
10	USN-900-1
6.8	USN-805-1
6.8	RHSA-2009:1140
6.8	MDVSA-2009:325
6.8	DSA-1860
5	MDVSA-2009:160
5	GLSA-200906-02
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 7 more Alert(s)