CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 0CVE-2012-5371 – ruby: Murmur hash-flooding DoS flaw in ruby 1.9 (oCERT-2012-001)
https://notcve.org/view.php?id=CVE-2012-5371
Ruby (aka CRuby) 1.9 before 1.9.3-p327 and 2.0 before r37575 computes hash values without properly restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table, as demonstrated by a universal multicollision attack against a variant of the MurmurHash2 algorithm, a different vulnerability than CVE-2011-4815. Ruby (también conocido como CRuby) v1.9 anteriores a v1.9.3-p327 y v2.0 anteriores a r37575 calcula los valores de hash sin restringir la posibilidad de provocar colisiones hash previsibles, lo que permite a atacantes dependientes de contexto provocar una denegación de servicio (consumo de CPU) a través de la manipulación de una entrada para la aplicación que mantiene la tabla de valores hash, como lo demuestra un ataque universal multicolision contra una variante del algoritmo MurmurHash2, una vulnerabilidad diferente a CVE-2011-4815. • http://2012.appsec-forum.ch/conferences/#c17 http://asfws12.files.wordpress.com/2012/11/asfws2012-jean_philippe_aumasson-martin_bosslet-hash_flooding_dos_reloaded.pdf http://secunia.com/advisories/51253 http://securitytracker.com/id?1027747 http://www.ocert.org/advisories/ocert-2012-001.html http://www.osvdb.org/87280 http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371 http://www.securityfocus.com/bid/56484 http://www.ubuntu.com/usn/USN-1733-1 http • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2012-4522 – ruby: unintentional file creation caused by inserting an illegal NUL character
https://notcve.org/view.php?id=CVE-2012-4522
The rb_get_path_check function in file.c in Ruby 1.9.3 before patchlevel 286 and Ruby 2.0.0 before r37163 allows context-dependent attackers to create files in unexpected locations or with unexpected names via a NUL byte in a file path. La función rb_get_path_check en file.c en Ruby v1.9.3 anterior a patchlevel 286 y Ruby v2.0.0 anterior a r37163 permite a atacantes dependientes de contexto crear archivos en ubicaciones inesperadas o con nombres inesperados a través de un byte NUL en una ruta de archivo. • http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090235.html http://lists.fedoraproject.org/pipermail/package-announce/2012-October/090515.html http://rhn.redhat.com/errata/RHSA-2013-0129.html http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37163 http://www.openwall.com/lists/oss-security/2012/10/12/6 http://www.openwall.com/lists/oss-security/2012/10/13/1 http://www.openwall.com/lists/oss-security/2012/10/16/1 http://www.ruby • CWE-264: Permissions, Privileges, and Access Controls CWE-626: Null Byte Interaction Error (Poison Null Byte) •
CVSS: 6.7EPSS: 0%CPEs: 1EXPL: 2CVE-2012-5380 – IKE and AuthIP IPsec Keyring Modules Service (IKEEXT) - Missing DLL
https://notcve.org/view.php?id=CVE-2012-5380
Untrusted search path vulnerability in the installation functionality in Ruby 1.9.3-p194, when installed in the top-level C:\ directory, might allow local users to gain privileges via a Trojan horse DLL in the C:\Ruby193\bin directory, which may be added to the PATH system environment variable by an administrator, as demonstrated by a Trojan horse wlbsctrl.dll file used by the "IKE and AuthIP IPsec Keying Modules" system service in Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, and Windows 8 Release Preview. NOTE: CVE disputes this issue because the unsafe PATH is established only by a separate administrative action that is not a default part of the Ruby installation ** DISPUTADA** Vulnerabilidad de path de búsqueda no confiable en la funcionalidad de instalación de Ruby 1.9.3-p194, cuando está instalada en el directorio C:\, podría permitir a usuarios locales obetner privilegios a través de un fichero DLL troyanizado en el directorio "C:\Ruby193\bin", el cual puede ser añadido a la variable de entorno PATH por un adminsitrador, como se demostró con el fichero wlbsctrl.dll troyanizado usado en el servicio de sistema "IKE and AuthIP IPsec Keying Modules" en Windows Vista SP1, Windows Server 2008 SP2, Windows 7 SP1, y Windows 8 Release Preview. NOTA: CVE disputa esta vulnerabilidad debida a un problema con PATH, que es un problema administrativo, y no es una parte por defecto de la instalación de Ruby. • https://www.exploit-db.com/exploits/28130 https://www.htbridge.com/advisory/HTB23108 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2012-4481 – ruby: Incomplete fix for CVE-2011-1005 for NameError#to_s method when used on objects
https://notcve.org/view.php?id=CVE-2012-4481
The safe-level feature in Ruby 1.8.7 allows context-dependent attackers to modify strings via the NameError#to_s method when operating on Ruby objects. NOTE: this issue is due to an incomplete fix for CVE-2011-1005. La funcionalidad safe-level de Ruby v1.8.7 permite a atacantes dependiendo del contexto modificar cadenas a través del método NameError#to_s mientras corren objetos Ruby. NOTA: este problema es debido a una corrección incompleta para CVE-2011-1005. • http://rhn.redhat.com/errata/RHSA-2013-0129.html http://rhn.redhat.com/errata/RHSA-2013-0612.html http://www.mandriva.com/security/advisories?name=MDVSA-2013:124 http://www.openwall.com/lists/oss-security/2012/10/05/4 https://bugzilla.redhat.com/show_bug.cgi?id=863484 https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0294 https://access.redhat.com/security/cve/CVE-2012-4481 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.0EPSS: 0%CPEs: 34EXPL: 0CVE-2012-4466 – ruby: safe level bypass via name_err_mesg_to_str()
https://notcve.org/view.php?id=CVE-2012-4466
Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286, and 2.0 before revision r37068 allows context-dependent attackers to bypass safe-level restrictions and modify untainted strings via the name_err_mesg_to_str API function, which marks the string as tainted, a different vulnerability than CVE-2011-1005. Ruby v1.8.7 antes de patchlevel 371, v1.9.3 antes patchlevel 286 y v2.0 antes de la revisión r37068 permite a atacantes dependientes de contexto evitar las restricciones de seguridad de nivel y modificar cadenas untainted a través de la función de la API name_err_mesg_to_str, que marca la cadena como contaminada, una diferente vulnerabilidad a CVE-2011-1005. • http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089554.html http://lists.fedoraproject.org/pipermail/package-announce/2012-October/089887.html http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37068 http://www.mandriva.com/security/advisories?name=MDVSA-2013:124 http://www.openwall.com/lists/oss-security/2012/10/02/4 http://www.openwall.com/lists/oss-security/2012/10/03/9 http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-4464-cve- • CWE-264: Permissions, Privileges, and Access Controls CWE-266: Incorrect Privilege Assignment •