Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2013-4164 | First vendor Publication | 2013-11-23 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
|---|---|---|---|
| Cvss Base Score | 6.8 | Attack Range | Network |
| Cvss Impact Score | 6.4 | Attack Complexity | Medium |
| Cvss Expoit Score | 8.6 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4164 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:19789 | |||
| Oval ID: | oval:org.mitre.oval:def:19789 | ||
| Title: | DSA-2810-1 ruby1.9.1 - heap overflow | ||
| Description: | Charlie Somerville discovered that Ruby incorrectly handled floating point number conversion. If an application using Ruby accepted untrusted input strings and converted them to floating point numbers, an attacker able to provide such input could cause the application to crash or, possibly, execute arbitrary code with the privileges of the application. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2810-1 CVE-2013-4164 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7 | Product(s): | ruby1.9.1 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:19939 | |||
| Oval ID: | oval:org.mitre.oval:def:19939 | ||
| Title: | DSA-2809-1 ruby1.8 - several | ||
| Description: | Several vulnerabilities have been discovered in the interpreter for the Ruby language. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2809-1 CVE-2013-1821 CVE-2013-4073 CVE-2013-4164 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/Linux 7 Debian GNU/kFreeBSD 6.0 Debian GNU/kFreeBSD 7 | Product(s): | ruby1.8 |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21247 | |||
| Oval ID: | oval:org.mitre.oval:def:21247 | ||
| Title: | RHSA-2013:1764: ruby security update (Critical) | ||
| Description: | Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2013:1764-00 CESA-2013:1764 CVE-2013-4164 | Version: | 4 |
| Platform(s): | Red Hat Enterprise Linux 6 CentOS Linux 6 | Product(s): | ruby |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:24019 | |||
| Oval ID: | oval:org.mitre.oval:def:24019 | ||
| Title: | ELSA-2013:1764: ruby security update (Critical) | ||
| Description: | Heap-based buffer overflow in Ruby 1.8, 1.9 before 1.9.3-p484, 2.0 before 2.0.0-p353, 2.1 before 2.1.0 preview2, and trunk before revision 43780 allows context-dependent attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a string that is converted to a floating point value, as demonstrated using (1) the to_f method or (2) JSON.parse. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2013:1764-00 CVE-2013-4164 | Version: | 6 |
| Platform(s): | Oracle Linux 6 | Product(s): | ruby |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:26963 | |||
| Oval ID: | oval:org.mitre.oval:def:26963 | ||
| Title: | DEPRECATED: ELSA-2013-1764 -- ruby security update (critical) | ||
| Description: | [1.8.7.352-13] - Workaround build issues against OpenSSL with enabled ECC curves. - Make DRb compatible with OpenSSL 1.0.1. * ruby-1.9.3-p222-generate-1024-bits-RSA-key-instead-of-512-bits.patch - Fix CVE-2013-4164 Heap Overflow in Floating Point Parsing * ruby-1.9.3-p484-CVE-2013-4164-ignore-too-long-fraction-part-which-does-not-affect-the-result.patch - Resolves: rhbz#1033500 | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2013-1764 CVE-2013-4164 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | ruby |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_ruby_20140731.nasl - Type : ACT_GATHER_INFO |
| 2015-01-19 | Name : The remote Solaris system is missing a security patch for third-party software. File : solaris11_ruby_20140114.nasl - Type : ACT_GATHER_INFO |
| 2014-12-15 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201412-27.nasl - Type : ACT_GATHER_INFO |
| 2014-11-12 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-1764.nasl - Type : ACT_GATHER_INFO |
| 2014-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-1767.nasl - Type : ACT_GATHER_INFO |
| 2014-10-21 | Name : The remote host is missing a security update for OS X Server. File : macosx_server_4_0.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-943.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-940.nasl - Type : ACT_GATHER_INFO |
| 2014-05-21 | Name : The remote host is missing a security update for OS X Server. File : macosx_server_3_1_2.nasl - Type : ACT_GATHER_INFO |
| 2014-04-22 | Name : The remote host is missing a Mac OS X update that fixes multiple security iss... File : macosx_SecUpd2014-002.nasl - Type : ACT_GATHER_INFO |
| 2014-03-21 | Name : A web application on the remote host is affected by multiple vulnerabilities. File : puppet_enterprise_311.nasl - Type : ACT_GATHER_INFO |
| 2013-12-17 | Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2013-350-06.nasl - Type : ACT_GATHER_INFO |
| 2013-12-14 | Name : The remote Fedora host is missing a security update. File : fedora_2013-22393.nasl - Type : ACT_GATHER_INFO |
| 2013-12-11 | Name : The remote Fedora host is missing a security update. File : fedora_2013-22315.nasl - Type : ACT_GATHER_INFO |
| 2013-12-05 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_ruby-131125.nasl - Type : ACT_GATHER_INFO |
| 2013-12-05 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2810.nasl - Type : ACT_GATHER_INFO |
| 2013-12-05 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2809.nasl - Type : ACT_GATHER_INFO |
| 2013-12-04 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20131125_ruby_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2013-12-04 | Name : The remote Fedora host is missing a security update. File : fedora_2013-22423.nasl - Type : ACT_GATHER_INFO |
| 2013-11-29 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-2035-1.nasl - Type : ACT_GATHER_INFO |
| 2013-11-29 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-1764.nasl - Type : ACT_GATHER_INFO |
| 2013-11-27 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-286.nasl - Type : ACT_GATHER_INFO |
| 2013-11-26 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-1764.nasl - Type : ACT_GATHER_INFO |
| 2013-11-26 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2013-248.nasl - Type : ACT_GATHER_INFO |
| 2013-11-26 | Name : The remote Amazon Linux AMI host is missing a security update. File : ala_ALAS-2013-247.nasl - Type : ACT_GATHER_INFO |
| 2013-11-25 | Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_cc9043cf7f7a426eb2cc8d1980618113.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 12:36:10 |
|
| 2021-05-04 12:27:08 |
|
| 2021-04-22 01:32:50 |
|
| 2020-05-23 13:17:03 |
|
| 2020-05-23 00:37:54 |
|
| 2018-01-09 13:22:58 |
|
| 2017-12-09 09:22:19 |
|
| 2016-12-31 09:24:18 |
|
| 2016-06-28 19:38:36 |
|
| 2016-04-26 23:30:48 |
|
| 2016-03-11 13:24:20 |
|
| 2016-03-11 09:23:58 |
|
| 2015-01-21 13:26:19 |
|
| 2014-12-16 13:25:02 |
|
| 2014-11-13 13:26:52 |
|
| 2014-11-08 13:31:04 |
|
| 2014-10-24 13:26:03 |
|
| 2014-10-22 13:25:38 |
|
| 2014-06-14 13:35:59 |
|
| 2014-05-22 13:24:05 |
|
| 2014-04-24 13:22:24 |
|
| 2014-04-23 13:22:20 |
|
| 2014-03-26 13:22:39 |
|
| 2014-03-22 13:21:10 |
|
| 2014-02-17 11:21:47 |
|
| 2014-01-24 13:19:21 |
|
| 2014-01-14 13:20:33 |
|
| 2014-01-03 17:19:04 |
|
| 2013-12-20 13:19:38 |
|
| 2013-12-08 13:19:30 |
|
| 2013-12-05 17:20:45 |
|
| 2013-11-27 21:28:04 |
|
| 2013-11-27 00:19:02 |
|
| 2013-11-26 09:21:15 |
|
| 2013-11-24 00:21:04 |
|
