CVE-2011-2705
ruby: Properly initialize the random number generator when forking new process
Severity Score
5.0
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before 1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.
La función SecureRandom.random_bytes de lib/securerandom.rb de Ruby en versiones anteriores a 1.8.7-p352 y 1.9.x anteriores a 1.9.2-p290 se basa en valores PID para la inicialización, lo que facilita a atacantes dependientes del contexto predecir la cadena resultado utilizando el conocimiento de cadenas aleatorias obtenidas en procesos anteriores con el mismo PID.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2011-07-11 CVE Reserved
- 2011-08-05 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (16)
| URL | Tag | Source |
|---|---|---|
| http://redmine.ruby-lang.org/issues/4579 | X_refsource_confirm | |
| http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog | X_refsource_confirm | |
| http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_290/ChangeLog | X_refsource_confirm | |
| http://www.securityfocus.com/bid/49015 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html | 2012-01-19 | |
| http://www.redhat.com/support/errata/RHSA-2011-1581.html | 2012-01-19 | |
| https://access.redhat.com/security/cve/CVE-2011-2705 | 2011-12-05 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | <= 1.8.7-334 Search vendor "Ruby-lang" for product "Ruby" and version " <= 1.8.7-334" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.8.7 Search vendor "Ruby-lang" for product "Ruby" and version "1.8.7" | p22 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.8.7 Search vendor "Ruby-lang" for product "Ruby" and version "1.8.7" | p71 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.8.7 Search vendor "Ruby-lang" for product "Ruby" and version "1.8.7" | p72 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.8.7-160 Search vendor "Ruby-lang" for product "Ruby" and version "1.8.7-160" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.8.7-173 Search vendor "Ruby-lang" for product "Ruby" and version "1.8.7-173" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.8.7-248 Search vendor "Ruby-lang" for product "Ruby" and version "1.8.7-248" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.8.7-249 Search vendor "Ruby-lang" for product "Ruby" and version "1.8.7-249" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.8.7-299 Search vendor "Ruby-lang" for product "Ruby" and version "1.8.7-299" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.8.7-302 Search vendor "Ruby-lang" for product "Ruby" and version "1.8.7-302" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.8.7-330 Search vendor "Ruby-lang" for product "Ruby" and version "1.8.7-330" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.8.7-p21 Search vendor "Ruby-lang" for product "Ruby" and version "1.8.7-p21" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9 Search vendor "Ruby-lang" for product "Ruby" and version "1.9" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9 Search vendor "Ruby-lang" for product "Ruby" and version "1.9" | r18423 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.0 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.0" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.0 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.0" | r18423 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.0-0 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.0-0" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.0-1 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.0-1" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.0-2 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.0-2" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.0-20060415 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.0-20060415" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.0-20070709 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.0-20070709" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.1 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.1" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.1 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.1" | -p0 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.1 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.1" | -p129 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.1 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.1" | -p243 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.1 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.1" | -p376 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.1 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.1" | -p429 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.1 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.1" | -preview_1 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.1 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.1" | -preview_2 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.1 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.1" | -rc1 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.1 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.1" | -rc2 |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.2 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.2" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.2 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.2" | dev |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.2-p136 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.2-p136" | - |
Affected
| ||||||
| Ruby-lang Search vendor "Ruby-lang" | Ruby Search vendor "Ruby-lang" for product "Ruby" | 1.9.2-p180 Search vendor "Ruby-lang" for product "Ruby" and version "1.9.2-p180" | - |
Affected
| ||||||