Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-99:1 advisory.

    Ruby is the interpreted scripting language for quick and easy object-oriented programming.  It has many     features to process text files and to do system management tasks (as in Perl).  It is simple, straight-     forward, and extensible.
    Security issues fixed with this release:
    CVE-2011-3009     Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-     dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence     obtained in a different child process, a related issue to CVE-2003-0900.
    CVE-2011-4815     Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash     collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU     consumption) via crafted input to an application that maintains a hash table.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-54:01 advisory.

    Ruby is the interpreted scripting language for quick and easy object-oriented programming.  It has many     features to process text files and to do system management tasks (as in Perl).  It is simple, straight-     forward, and extensible.
    Security issues fixed with this release:
    CVE-2011-2705     The SecureRandom.random_bytes function in lib/securerandom.rb in Ruby before 1.8.7-p352 and 1.9.x before     1.9.2-p290 relies on PID values for initialization, which makes it easier for context-dependent attackers     to predict the result string by leveraging knowledge of random strings obtained in an earlier process with     the same PID.
    CVE-2011-3009     Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-     dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence     obtained in a different child process, a related issue to CVE-2003-0900.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1581 advisory.

    - Update to Ruby 1.8.7-p352.
      * Remove Patch43: ruby-1.8.7-CVE-2011-1004.patch; subsumed
      * Remove Patch44: ruby-1.8.7-CVE-2011-1005.patch; subsumed
      * Remove Patch200: ruby-1.8.7-webrick-CVE.patch; subsumed
    - Address CVE-2011-1004 'Symlink race condition by removing directory trees in       fileutils module'
      * ruby-1.8.7-CVE-2011-1004.patch
    - Address CVE-2011-1005 'Untrusted codes able to modify arbitrary strings'
      * ruby-1.8.7-CVE-2011-1005.patch
    - Address CVE-2011-0188 'memory corruption in BigDecimal on 64bit platforms'
      * ruby-1.8.7-CVE-2011-0188.patch

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of ruby provides 1.8.7p357, which contains many stability fixes and bug fixes, which are fully compatible with the previous version. You can review the detailed list here :

http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_357/ChangeLog

The particularly noteworthy fixes are :

  - Hash functions are now using a randomized seed to avoid     algorithmic complexity attacks (CVE-2011-4815). For this     OpenSSL::Random.seed at the SecureRandom.random_bytes is     used if available.

  - mkconfig.rb: fix for continued lines.

  - Fix Infinity to be greater than any bignum number.

  - initialize store->ex_data.sk.

  - some IPv6 related fixes

  - zlib fixes

  - reinitialize PRNG when forking children     (CVE-2011-2686/CVE-2011-3009)

  - securerandom fixes (CVE-2011-2705)

  - uri route_to fixes

  - fix race condition with variables and autoload

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0070 advisory.

    - Properly initialize the random number generator when forking new process
      * ruby-1.8.7-CVE-2011-3009.patch
      - Related: rhbz#768829

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update of ruby provides 1.8.7p357, which contains many stability fixes and bug fixes while maintaining full compatibility with the previous version. A detailailed list of changes is available from http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_357/ChangeLog .

The most important fixes are :

  - Hash functions are now using a randomized seed to avoid     algorithmic complexity attacks. If available,     OpenSSL::Random.seed at the SecureRandom.random_bytes is     used to achieve this. (CVE-2011-4815)

  - mkconfig.rb: fix for continued lines.

  - Fix Infinity to be greater than any bignum number.

  - Initialize store->ex_data.sk.

  - Several IPv6 related fixes.

  - Fixes for zlib.

  - Reinitialize PRNG when forking children. (CVE-2011-2686     / CVE-2011-3009)

  - Fixes to securerandom. (CVE-2011-2705)

  - Fix uri route_to

  - Fix race condition with variables and autoload.

Updated ruby packages that fix two security issues are now available for Red Hat Enterprise Linux 4 and 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.

A denial of service flaw was found in the implementation of associative arrays (hashes) in Ruby. An attacker able to supply a large number of inputs to a Ruby application (such as HTTP POST request parameters sent to a web application) that are used as keys when inserting data into an array could trigger multiple hash function collisions, making array operations take an excessive amount of CPU time. To mitigate this issue, randomization has been added to the hash function to reduce the chance of an attacker successfully causing intentional collisions. (CVE-2011-4815)

It was found that Ruby did not reinitialize the PRNG (pseudorandom number generator) after forking a child process. This could eventually lead to the PRNG returning the same result twice. An attacker keeping track of the values returned by one child process could use this flaw to predict the values the PRNG would return in other child processes (as long as the parent process persisted). (CVE-2011-3009)

Red Hat would like to thank oCERT for reporting CVE-2011-4815. oCERT acknowledges Julian Walde and Alexander Klink as the original reporters of CVE-2011-4815.

All users of ruby are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:1581 advisory.

    Ruby is an extensible, interpreted, object-oriented, scripting language. It     has features to process text files and to do system management tasks.

    It was found that Ruby did not reinitialize the PRNG (pseudorandom number     generator) after forking a child process. This could eventually lead to the     PRNG returning the same result twice. An attacker keeping track of the     values returned by one child process could use this flaw to predict the     values the PRNG would return in other child processes (as long as the     parent process persisted). (CVE-2011-3009)

    A flaw was found in the Ruby SecureRandom module. When using the     SecureRandom.random_bytes class, the PRNG state was not modified after     forking a child process. This could eventually lead to     SecureRandom.random_bytes returning the same string more than once. An     attacker keeping track of the strings returned by one child process could     use this flaw to predict the strings SecureRandom.random_bytes would return     in other child processes (as long as the parent process persisted).
    (CVE-2011-2705)

    This update also fixes the following bugs:

    * The ruby package has been upgraded to upstream point release 1.8.7-p352,     which provides a number of bug fixes over the previous version. (BZ#706332)

    * The MD5 message-digest algorithm is not a FIPS-approved algorithm.
    Consequently, when a Ruby script attempted to calculate an MD5 checksum in     FIPS mode, the interpreter terminated unexpectedly. This bug has been fixed     and an exception is now raised in the described scenario. (BZ#717709)

    * Due to inappropriately handled line continuations in the mkconfig.rb     source file, an attempt to build the ruby package resulted in unexpected     termination. An upstream patch has been applied to address this issue and     the ruby package can now be built properly. (BZ#730287)

    * When the 32-bit ruby-libs library was installed on a 64-bit machine, the     mkmf library failed to load various modules necessary for building     Ruby-related packages. This bug has been fixed and mkmf now works properly     in the described scenario. (BZ#674787)

    * Previously, the load paths for scripts and binary modules were duplicated     on the i386 architecture. Consequently, an ActiveSupport test failed. With     this update, the load paths are no longer stored in duplicates on the i386     architecture. (BZ#722887)

    This update also adds the following enhancement:

    * With this update, SystemTap probes have been added to the ruby package.
    (BZ#673162)

    All users of ruby are advised to upgrade to these updated packages, which     resolve these issues and add this enhancement.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
291505	MiracleLinux 3 : ruby-1.8.5-22.1.0.1.AXS3 (AXSA:2012-99:1)	Nessus	Miracle Linux Local Security Checks	high
291502	MiracleLinux 4 : ruby-1.8.7.352-3.0.1.AXS4 (AXSA:2012-54:01)	Nessus	Miracle Linux Local Security Checks	high
181024	Oracle Linux 6 : ruby (ELSA-2011-1581)	Nessus	Oracle Linux Local Security Checks	high
76015	openSUSE Security Update : ruby (openSUSE-SU-2012:0228-1)	Nessus	SuSE Local Security Checks	high
68441	Oracle Linux 5 : ruby (ELSA-2012-0070)	Nessus	Oracle Linux Local Security Checks	high
57841	SuSE 11.1 Security Update : ruby (SAT Patch Number 5716)	Nessus	SuSE Local Security Checks	high
57840	SuSE 11.1 Security Update : ruby (SAT Patch Number 5716)	Nessus	SuSE Local Security Checks	high
57747	RHEL 4 / 5 : ruby (RHSA-2012:0070)	Nessus	Red Hat Local Security Checks	high
57734	CentOS 4 / 5 : ruby (CESA-2012:0070)	Nessus	CentOS Local Security Checks	high
57017	RHEL 6 : ruby (RHSA-2011:1581)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2011-3009

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high