CVSS: 5.0EPSS: 0%CPEs: 35EXPL: 0CVE-2011-2705 – ruby: Properly initialize the random number generator when forking new process
https://notcve.org/view.php?id=CVE-2011-2705
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID. La función SecureRandom.random_bytes de lib/securerandom.rb de Ruby en versiones anteriores a 1.8.7-p352 y 1.9.x anteriores a 1.9.2-p290 se basa en valores PID para la inicialización, lo que facilita a atacantes dependientes del contexto predecir la cadena resultado utilizando el conocimiento de cadenas aleatorias obtenidas en procesos anteriores con el mismo PID. • http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html http://redmine.ruby-lang.org/issues/4579 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050 http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_290/ChangeLog http://www.openwall.com/lists/oss-security/2011/07/11/1 http://www.ope • CWE-20: Improper Input Validation •
CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2011-2686
https://notcve.org/view.php?id=CVE-2011-2686
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development. Ruby en versiones anteriores a la 1.8.7-p352 no resetea la semilla aleatoria después de la creacción de procesos ("forking"), lo que facilita a atacantes dependientes del contexto predecir los valores de números aleatorios basándose en el conocimiento de números de secuencia obtenidos de procesos hijo diferentes. Vulnerabilidad relacionada con la CVE-2003-0900. NOTA: este problema existe debido a una regresión durante el desarrollo de Ruby 1.8.6. • http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html http://redmine.ruby-lang.org/issues/show/4338 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=31713 http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog http://www.openwall.com/lists/oss-security/2011/07/11/1 http://www.openwall.com/lists/oss-security/2011/07/12/14 http://www.openw • CWE-310: Cryptographic Issues •
CVSS: 6.8EPSS: 2%CPEs: 38EXPL: 0CVE-2011-0188 – ruby: memory corruption in BigDecimal on 64bit platforms
https://notcve.org/view.php?id=CVE-2011-0188
The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an "integer truncation issue." La función VpMemAlloc en bigdecimal.c en la clase BigDecimal en Ruby v1.9.2-P136 y anteriores, tal como se utiliza en Apple Mac OS X antes de vv10.6.7 y en otras plataformas, no asigna memoria adecuadamente, lo que permite a atacantes dependientes de contexto ejecutar código de su elección o causar una denegación de servicio (caída de aplicación) a través de vectores que impliquen la creación de un valor BigDecimal grande dentro de un proceso de 64 bits, relacionado con un "fallo de truncado de entero". • http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html http://support.apple.com/kb/HT4581 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi/trunk/ext/bigdecimal/bigdecimal.c?r1=29364&r2=30993 http://www.mandriva.com/security/advisories?name=MDVSA-2011:097 http://www.mandriva.com/security/advisories?name=MDVSA-2011:098 http://www.redhat.com/support/errata/RHSA-2011-0908.html http://www.redhat.com/support/errata/RHSA-2011-0909.html http://www.redhat.com/support/ • CWE-189: Numeric Errors •
CVSS: 6.8EPSS: 2%CPEs: 2EXPL: 1CVE-2009-0642 – ruby: Incorrect checks for validity of X.509 certificates
https://notcve.org/view.php?id=CVE-2009-0642
ext/openssl/ossl_ocsp.c in Ruby 1.8 and 1.9 does not properly check the return value from the OCSP_basic_verify function, which might allow remote attackers to successfully present an invalid X.509 certificate, possibly involving a revoked certificate. ext/openssl/ossl_ocsp.c en Ruby v1.8 y v1.9 no comprueba adecuadamente el valor de retorno de la funcion OCSP_basic_verify, lo cual permitiria a atacantes remotos tener exito en la presentacion de un certificado X.509 invalido, posiblemente utilizando un certificado revocado. • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513528 http://redmine.ruby-lang.org/issues/show/1091 http://secunia.com/advisories/33750 http://secunia.com/advisories/35699 http://secunia.com/advisories/35937 http://www.mandriva.com/security/advisories?name=MDVSA-2009:193 http://www.redhat.com/support/errata/RHSA-2009-1140.html http://www.securityfocus.com/bid/33769 http://www.securitytracker.com/id?1022505 http://www.ubuntu.com/usn/USN-805-1 https://exchange.xfor • CWE-287: Improper Authentication •
CVSS: 5.8EPSS: 1%CPEs: 27EXPL: 1CVE-2008-3905 – ruby: use of predictable source port and transaction id in DNS requests done by resolv.rb module
https://notcve.org/view.php?id=CVE-2008-3905
resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447. resolv.rb en Ruby 1.8.5 y versiones anteriores, 1.8.6 versiones anteriores a 1.8.6-p287, 1.8.7 versiones anteriores a 1.8.7-p72, y 1.9 r18423 y versiones anteriores utiliza transacciones secuenciales de IDs y puertos de origen constante para peticiones DNS, lo cual hace más sencillo para atacantes remotos envenenar respuestas DNS, una vulnerabilidad diferente a CVE-2008-1447. • http://secunia.com/advisories/31430 http://secunia.com/advisories/32165 http://secunia.com/advisories/32219 http://secunia.com/advisories/32255 http://secunia.com/advisories/32256 http://secunia.com/advisories/32371 http://secunia.com/advisories/32948 http://secunia.com/advisories/33178 http://security.gentoo.org/glsa/glsa-200812-17.xml http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.371754 http://support.avaya.com/elmodocs2/security/ASA- • CWE-287: Improper Authentication •