Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.

This update fixes multiple local and remote denial of service and remote code execute problems :

CVE-2011-0188 Properly allocate memory, to prevent arbitrary code execution or application crash. Reported by Drew Yao.

CVE-2011-2686

Reinitialize the random seed when forking to prevent CVE-2003-0900 like situations.

CVE-2011-2705 Modify PRNG state to prevent random number sequence repeatation at forked child process which has same pid. Reported by Eric Wong.

CVE-2011-4815

Fix a problem with predictable hash collisions resulting in denial of service (CPU consumption) attacks. Reported by Alexander Klink and Julian Waelde.

CVE-2014-8080

Fix REXML parser to prevent memory consumption denial of service via crafted XML documents. Reported by Willis Vandevanter.

CVE-2014-8090

Add REXML::Document#document to complement the fix for CVE-2014-8080.
Reported by Tomas Hoger.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of ruby provides 1.8.7p357, which contains many stability fixes and bug fixes, which are fully compatible with the previous version. You can review the detailed list here :

http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_357/ChangeLog

The particularly noteworthy fixes are :

  - Hash functions are now using a randomized seed to avoid     algorithmic complexity attacks (CVE-2011-4815). For this     OpenSSL::Random.seed at the SecureRandom.random_bytes is     used if available.

  - mkconfig.rb: fix for continued lines.

  - Fix Infinity to be greater than any bignum number.

  - initialize store->ex_data.sk.

  - some IPv6 related fixes

  - zlib fixes

  - reinitialize PRNG when forking children     (CVE-2011-2686/CVE-2011-3009)

  - securerandom fixes (CVE-2011-2705)

  - uri route_to fixes

  - fix race condition with variables and autoload

The ruby interpreter received a fix for two security issues :

  - Ruby's $SAFE mechanism enables untrusted user codes to     run in $SAFE >= 4 mode. This is a kind of sandboxing so     some operations are restricted in that mode to protect     other data outside the sandbox. (CVE-2012-4466)

    The problem found was around this mechanism.
    Exception#to_s, NameError#to_s, and name_err_mesg_to_s()     interpreter-internal API was not correctly handling the     $SAFE bits so a String object which is not tainted can     destructively be marked as tainted using them. By using     this an untrusted code in a sandbox can modify a     formerly-untainted string destructively.

    http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-446     4-cve-2012-4466/

  - Ruby before 1.8.7-p352 does not reset the random seed     upon forking, which makes it easier for     context-dependent attackers to predict the values of     random numbers by leveraging knowledge of the number     sequence obtained in a different child process.
    (CVE-2011-2686)

  - Fix entity expansion DoS vulnerability in REXML. When     reading text nodes from an XML document, the REXML     parser could be coerced into allocating extremely large     string objects which could consume all available memory     on the system. (CVE-2013-1821)

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.

A denial of service flaw was found in the implementation of associative arrays (hashes) in Ruby. An attacker able to supply a large number of inputs to a Ruby application (such as HTTP POST request parameters sent to a web application) that are used as keys when inserting data into an array could trigger multiple hash function collisions, making array operations take an excessive amount of CPU time. To mitigate this issue, randomization has been added to the hash function to reduce the chance of an attacker successfully causing intentional collisions. (CVE-2011-4815)

It was found that Ruby did not reinitialize the PRNG (pseudorandom number generator) after forking a child process. This could eventually lead to the PRNG returning the same result twice. An attacker keeping track of the values returned by one child process could use this flaw to predict the values the PRNG would return in other child processes (as long as the parent process persisted). (CVE-2011-3009)

All users of ruby are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.

It was found that Ruby did not reinitialize the PRNG (pseudorandom number generator) after forking a child process. This could eventually lead to the PRNG returning the same result twice. An attacker keeping track of the values returned by one child process could use this flaw to predict the values the PRNG would return in other child processes (as long as the parent process persisted). (CVE-2011-3009)

A flaw was found in the Ruby SecureRandom module. When using the SecureRandom.random_bytes class, the PRNG state was not modified after forking a child process. This could eventually lead to SecureRandom.random_bytes returning the same string more than once. An attacker keeping track of the strings returned by one child process could use this flaw to predict the strings SecureRandom.random_bytes would return in other child processes (as long as the parent process persisted). (CVE-2011-2705)

This update also fixes the following bugs :

  - The ruby package has been upgraded to upstream point     release 1.8.7-p352, which provides a number of bug fixes     over the previous version.

  - The MD5 message-digest algorithm is not a FIPS-approved     algorithm. Consequently, when a Ruby script attempted to     calculate an MD5 checksum in FIPS mode, the interpreter     terminated unexpectedly. This bug has been fixed and an     exception is now raised in the described scenario.

  - Due to inappropriately handled line continuations in the     mkconfig.rb source file, an attempt to build the ruby     package resulted in unexpected termination. An upstream     patch has been applied to address this issue and the     ruby package can now be built properly.

  - When the 32-bit ruby-libs library was installed on a     64-bit machine, the mkmf library failed to load various     modules necessary for building Ruby-related packages.
    This bug has been fixed and mkmf now works properly in     the described scenario.

  - Previously, the load paths for scripts and binary     modules were duplicated on the i386 architecture.
    Consequently, an ActiveSupport test failed. With this     update, the load paths are no longer stored in     duplicates on the i386 architecture.

This update also adds the following enhancement :

  - With this update, SystemTap probes have been added to     the ruby package.

All users of ruby are advised to upgrade to these updated packages, which resolve these issues and add this enhancement.

Drew Yao discovered that the WEBrick HTTP server was vulnerable to cross-site scripting attacks when displaying error pages. A remote attacker could use this flaw to run arbitrary web script.
(CVE-2010-0541)

Drew Yao discovered that Ruby's BigDecimal module did not properly allocate memory on 64-bit platforms. An attacker could use this flaw to cause a denial of service or possibly execute arbitrary code with user privileges. (CVE-2011-0188)

Nicholas Jefferson discovered that the FileUtils.remove_entry_secure method in Ruby did not properly remove non-empty directories. An attacker could use this flaw to possibly delete arbitrary files.
(CVE-2011-1004)

It was discovered that Ruby incorrectly allowed untainted strings to be modified in protective safe levels. An attacker could use this flaw to bypass intended access restrictions. (CVE-2011-1005)

Eric Wong discovered that Ruby does not properly reseed its pseudorandom number generator when creating child processes. An attacker could use this flaw to gain knowledge of the random numbers used in other Ruby child processes. (CVE-2011-2686)

Eric Wong discovered that the SecureRandom module in Ruby did not properly seed its pseudorandom number generator. An attacker could use this flaw to gain knowledge of the random numbers used by another Ruby process with the same process ID number. (CVE-2011-2705)

Alexander Klink and Julian Walde discovered that Ruby computed hash values without restricting the ability to trigger hash collisions predictably. A remote attacker could cause a denial of service by crafting values used in hash tables. (CVE-2011-4815).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of ruby provides 1.8.7p357, which contains many stability fixes and bug fixes while maintaining full compatibility with the previous version. A detailailed list of changes is available from http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_357/ChangeLog .

The most important fixes are :

  - Hash functions are now using a randomized seed to avoid     algorithmic complexity attacks. If available,     OpenSSL::Random.seed at the SecureRandom.random_bytes is     used to achieve this. (CVE-2011-4815)

  - mkconfig.rb: fix for continued lines.

  - Fix Infinity to be greater than any bignum number.

  - Initialize store->ex_data.sk.

  - Several IPv6 related fixes.

  - Fixes for zlib.

  - Reinitialize PRNG when forking children. (CVE-2011-2686     / CVE-2011-3009)

  - Fixes to securerandom. (CVE-2011-2705)

  - Fix uri route_to

  - Fix race condition with variables and autoload.

New version 1.8.7p352 is released, fixing randomization process in forked process (CVE-2011-2686). Also ruby path is fixed to have no duplicate directories on all archs.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
82233	Debian DLA-88-1 : ruby1.8 security update	Nessus	Debian Local Security Checks	high
76015	openSUSE Security Update : ruby (openSUSE-SU-2012:0228-1)	Nessus	SuSE Local Security Checks	high
65799	SuSE 10 Security Update : ruby (ZYPP Patch Number 8524)	Nessus	SuSE Local Security Checks	medium
61228	Scientific Linux Security Update : ruby on SL4.x, SL5.x i386/x86_64 (20120130)	Nessus	Scientific Linux Local Security Checks	high
61197	Scientific Linux Security Update : ruby on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58146	Ubuntu 10.04 LTS / 10.10 / 11.04 / 11.10 : ruby1.8 vulnerabilities (USN-1377-1)	Nessus	Ubuntu Local Security Checks	high
57841	SuSE 11.1 Security Update : ruby (SAT Patch Number 5716)	Nessus	SuSE Local Security Checks	high
57840	SuSE 11.1 Security Update : ruby (SAT Patch Number 5716)	Nessus	SuSE Local Security Checks	high
55678	Fedora 14 : ruby-1.8.7.352-1.fc14 (2011-9374)	Nessus	Fedora Local Security Checks	medium
55677	Fedora 15 : ruby-1.8.7.352-1.fc15 (2011-9359)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-2686

critical

Tenable Plugins

high

high

medium

high

medium

high

high

high

medium

medium