lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.

The remote host is affected by the vulnerability described in GLSA-201412-27 (Ruby: Denial of Service)

    Multiple vulnerabilities have been discovered in Ruby. Please review the       CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker could possibly execute arbitrary code with       the privileges of the process, cause a Denial of Service condition, or       bypass security restrictions.
  Workaround :

    There is no known workaround at this time.

Ruby 1.8 was updated to fix a XML entity expansion denial of service attack (CVE-2013-1821)

Ruby 1.9 was updated to 1.9.3 p392, fixing the same security issues and also :

  - update json intree to 1.5.5: Denial of Service and     Unsafe Object Creation Vulnerability in JSON     CVE-2013-0269

  - limit entity expansion text limit to 10kB CVE-2013-1821

  - get rid of a SEGV when calling rb_iter_break() from some     extention libraries.

  - some warning suppressed and smaller fixes

This Ruby update fixes the following security issue :

  - Fixed entity expansion DoS vulnerability in REXML.
    (CVE-2013-1821). (bnc#808137)

Several vulnerabilities have been discovered in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-1821     Ben Murphy discovered that unrestricted entity expansion     in REXML can lead to a Denial of Service by consuming     all host memory.

  - CVE-2013-4073     William (B.J.) Snow Orvis discovered a vulnerability in     the hostname checking in Ruby's SSL client that could     allow man-in-the-middle attackers to spoof SSL servers     via a crafted certificate issued by a trusted     certification authority.

  - CVE-2013-4164     Charlie Somerville discovered that Ruby incorrectly     handled floating point number conversion. If an     application using Ruby accepted untrusted input strings     and converted them to floating point numbers, an     attacker able to provide such input could cause the     application to crash or, possibly, execute arbitrary     code with the privileges of the application.

It was discovered that Ruby's REXML library did not properly restrict XML entity expansion. An attacker could use this flaw to cause a denial of service by tricking a Ruby application using REXML to read text nodes from specially crafted XML content, which will result in REXML consuming large amounts of system memory. (CVE-2013-1821)

It was found that the RHSA-2011-0910 update did not correctly fix the CVE-2011-1005 issue, a flaw in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2012-4481)

The safe-level feature in Ruby 1.8.6 through 1.8.6-420, 1.8.7 through 1.8.7-330, and 1.8.8dev allows context-dependent attackers to modify strings via the Exception#to_s method, as demonstrated by changing an intended pathname. (CVE-2011-1005)

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may lead to denial of service and other security problems. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2013-1821     Ben Murphy discovered that unrestricted entity expansion     in REXML can lead to a Denial of Service by consuming     all host memory.

  - CVE-2013-4073     William (B.J.) Snow Orvis discovered a vulnerability in     the hostname checking in Ruby's SSL client that could     allow man-in-the-middle attackers to spoof SSL servers     via valid certificate issued by a trusted certification     authority.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0612 advisory.

    -  escaping vulnerability about Exception#to_s / NameError#to_s
      * ruby-1.8.7-p371-CVE-2012-4481.patch
      - Related: rhbz#915379

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2013-0611 advisory.

    [1.8.5-29]
    - Fix regression introduced by fix for entity expansion DOS vulnerability       in REXML (https://bugs.ruby-lang.org/issues/7961)
      * ruby-2.0.0-add-missing-rexml-require.patch
    - Related: rhbz#915377

    [1.8.5-28]
    - Addresses entity expansion DoS vulnerability in REXML.
      * ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch
    - Resolves: rhbz#915377

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated ruby packages fix security vulnerabilities :

Shugo Maedo and Vit Ondruch discovered that Ruby incorrectly allowed untainted strings to be modified in protective safe levels. An attacker could use this flaw to bypass intended access restrictions (CVE-2012-4466, CVE-2012-4481).

It was discovered that Ruby's REXML library did not properly restrict XML entity expansion. An attacker could use this flaw to cause a denial of service by tricking a Ruby application using REXML to read text nodes from specially crafted XML content, which will result in REXML consuming large amounts of system memory (CVE-2013-1821).

The ruby interpreter received a fix for two security issues :

  - Ruby's $SAFE mechanism enables untrusted user codes to     run in $SAFE >= 4 mode. This is a kind of sandboxing so     some operations are restricted in that mode to protect     other data outside the sandbox. (CVE-2012-4466)

    The problem found was around this mechanism.
    Exception#to_s, NameError#to_s, and name_err_mesg_to_s()     interpreter-internal API was not correctly handling the     $SAFE bits so a String object which is not tainted can     destructively be marked as tainted using them. By using     this an untrusted code in a sandbox can modify a     formerly-untainted string destructively.

    http://www.ruby-lang.org/en/news/2012/10/12/cve-2012-446     4-cve-2012-4466/

  - Ruby before 1.8.7-p352 does not reset the random seed     upon forking, which makes it easier for     context-dependent attackers to predict the values of     random numbers by leveraging knowledge of the number     sequence obtained in a different child process.
    (CVE-2011-2686)

  - Fix entity expansion DoS vulnerability in REXML. When     reading text nodes from an XML document, the REXML     parser could be coerced into allocating extremely large     string objects which could consume all available memory     on the system. (CVE-2013-1821)

Ben Murphy discovered that the Ruby REXML library incorrectly handled XML entity expansion. An attacker could use this flaw to cause Ruby to consume large amounts of memory, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New ruby packages are available for Slackware 13.1, 13.37, 14.0, and
-current to fix security issues.

Updated ruby packages that fix two security issues are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.

It was discovered that Ruby's REXML library did not properly restrict XML entity expansion. An attacker could use this flaw to cause a denial of service by tricking a Ruby application using REXML to read text nodes from specially crafted XML content, which will result in REXML consuming large amounts of system memory. (CVE-2013-1821)

It was found that the RHSA-2011:0910 update did not correctly fix the CVE-2011-1005 issue, a flaw in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2012-4481)

The CVE-2012-4481 issue was discovered by Vit Ondruch of Red Hat.

All users of Ruby are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

It was discovered that Ruby's REXML library did not properly restrict XML entity expansion. An attacker could use this flaw to cause a denial of service by tricking a Ruby application using REXML to read text nodes from specially crafted XML content, which will result in REXML consuming large amounts of system memory. (CVE-2013-1821)

It was found that the SLSA-2011:0910 update did not correctly fix the CVE-2011-1005 issue, a flaw in the method for translating an exception message into a string in the Exception class. A remote attacker could use this flaw to bypass safe level 4 restrictions, allowing untrusted (tainted) code to modify arbitrary, trusted (untainted) strings, which safe level 4 restrictions would otherwise prevent. (CVE-2012-4481)

The CVE-2012-4481 issue was discovered by Vit Ondruch of Red Hat.

It was discovered that Ruby's REXML library did not properly restrict XML entity expansion. An attacker could use this flaw to cause a denial of service by tricking a Ruby application using REXML to read text nodes from specially crafted XML content, which will result in REXML consuming large amounts of system memory. (CVE-2013-1821)

Updated ruby packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to do system management tasks.

It was discovered that Ruby's REXML library did not properly restrict XML entity expansion. An attacker could use this flaw to cause a denial of service by tricking a Ruby application using REXML to read text nodes from specially crafted XML content, which will result in REXML consuming large amounts of system memory. (CVE-2013-1821)

All users of Ruby are advised to upgrade to these updated packages, which contain backported patches to resolve this issue.

ID	Name	Product	Family	Severity
79980	GLSA-201412-27 : Ruby: Denial of Service	Nessus	Gentoo Local Security Checks	high
74955	openSUSE Security Update : ruby (openSUSE-SU-2013:0603-1)	Nessus	SuSE Local Security Checks	high
74118	SuSE 11.3 Security Update : Ruby (SAT Patch Number 9136)	Nessus	SuSE Local Security Checks	medium
71220	Debian DSA-2809-1 : ruby1.8 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
69753	Amazon Linux AMI : ruby19 (ALAS-2013-195)	Nessus	Amazon Linux Local Security Checks	medium
69732	Amazon Linux AMI : ruby (ALAS-2013-173)	Nessus	Amazon Linux Local Security Checks	medium
69398	Debian DSA-2738-1 : ruby1.9.1 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
68782	Oracle Linux 6 : ruby (ELSA-2013-0612)	Nessus	Oracle Linux Local Security Checks	medium
68781	Oracle Linux 5 : ruby (ELSA-2013-0611)	Nessus	Oracle Linux Local Security Checks	medium
66136	Mandriva Linux Security Advisory : ruby (MDVSA-2013:124)	Nessus	Mandriva Local Security Checks	medium
65799	SuSE 10 Security Update : ruby (ZYPP Patch Number 8524)	Nessus	SuSE Local Security Checks	medium
65686	Ubuntu 10.04 LTS / 11.10 / 12.04 LTS / 12.10 : ruby1.8, ruby1.9.1 vulnerability (USN-1780-1)	Nessus	Ubuntu Local Security Checks	medium
65583	Slackware 13.1 / 13.37 / 14.0 / current : ruby (SSA:2013-075-01)	Nessus	Slackware Local Security Checks	high
65166	CentOS 6 : ruby (CESA-2013:0612)	Nessus	CentOS Local Security Checks	medium
65094	Scientific Linux Security Update : ruby on SL6.x i386/x86_64 (20130307)	Nessus	Scientific Linux Local Security Checks	medium
65093	Scientific Linux Security Update : ruby on SL5.x i386/x86_64 (20130307)	Nessus	Scientific Linux Local Security Checks	medium
65085	RHEL 6 : ruby (RHSA-2013:0612)	Nessus	Red Hat Local Security Checks	medium
65084	RHEL 5 : ruby (RHSA-2013:0611)	Nessus	Red Hat Local Security Checks	medium
65080	CentOS 5 : ruby (CESA-2013:0611)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2013-1821

medium

Tenable Plugins

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium