Detections
Analytics
Oracle Linux 6 : ruby193-ruby (ELSA-2014-1913)
high Nessus Plugin ID 181041
Language:
Synopsis
The remote Oracle Linux host is missing one or more security updates.Description
The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2014-1913 advisory.- The REXML parser in Ruby 1.9.x before 1.9.3-p550, 2.0.x before 2.0.0-p594, and 2.1.x before 2.1.4 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document, aka an XML Entity Expansion (XEE) attack. (CVE-2014-8080)
- The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nested entity references, aka an XML Entity Expansion (XEE) attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-1821 and CVE-2014-8080. (CVE-2014-8090)
- Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent attackers to cause a denial of service (segmentation fault) via vectors that trigger a stack-based buffer overflow. (CVE-2014-4975)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
Plugin Details
Severity: High
ID: 181041
File Name: oraclelinux_ELSA-2014-1913.nasl
Version: 1.0
Type: local
Agent: unix
Published: 9/7/2023
Updated: 9/7/2023
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5
Temporal Score: 3.9
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2014-4975
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2014-8090
Vulnerability Information
CPE: cpe:/o:oracle:linux:6, p-cpe:/a:oracle:linux:ruby193-ruby, p-cpe:/a:oracle:linux:ruby193-ruby-devel, p-cpe:/a:oracle:linux:ruby193-ruby-doc, p-cpe:/a:oracle:linux:ruby193-ruby-irb, p-cpe:/a:oracle:linux:ruby193-ruby-libs, p-cpe:/a:oracle:linux:ruby193-ruby-tcltk, p-cpe:/a:oracle:linux:ruby193-rubygem-bigdecimal, p-cpe:/a:oracle:linux:ruby193-rubygem-io-console, p-cpe:/a:oracle:linux:ruby193-rubygem-json, p-cpe:/a:oracle:linux:ruby193-rubygem-minitest, p-cpe:/a:oracle:linux:ruby193-rubygem-rake, p-cpe:/a:oracle:linux:ruby193-rubygem-rdoc, p-cpe:/a:oracle:linux:ruby193-rubygems, p-cpe:/a:oracle:linux:ruby193-rubygems-devel
Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/OracleLinux
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 2/4/2016
Vulnerability Publication Date: 7/9/2014