Fix for jdom: XML Parsing Vulnerability affecting JRuby users.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Mac OS X host has a version of OS X Server installed that is prior to 3.0. It is, therefore, affected by the following vulnerabilities :

  - A denial of service vulnerability exists in the     included JSON Ruby Gem, which can be abused to exhaust     all available memory resources. (CVE-2013-0269)

  - Multiple cross-site scripting vulnerabilities exist in     the included Ruby on Rails software. (CVE-2013-1854 /     CVE-2013-1855 / CVE-2013-1856 / CVE-2013-1857)

  - A buffer overflow exists in the included FreeRADIUS     software that can be triggered when parsing the 'not     after' timestamp in a client certificate when using     TLS-based EAP methods. (CVE-2012-3547)

  - A logic issue exists whereby the RADIUS service could     choose an incorrect certificate from a list of     configured certificates.

Ruby on Rails team reports :

Rails versions 3.2.13 has been released. This release contains important security fixes. It is recommended users upgrade as soon as possible.

Four vulnerabilities have been discovered and fixed :

- (CVE-2013-1854) Symbol DoS vulnerability in Active Record

- (CVE-2013-1855) XSS vulnerability in sanitize_css in Action Pack

- (CVE-2013-1856) XML Parsing Vulnerability affecting JRuby users

- (CVE-2013-1857) XSS Vulnerability in the `sanitize` helper of Ruby on Rails

The remote host is affected by the vulnerability described in GLSA-201412-28 (Ruby on Rails: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Ruby on Rails. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code or cause a Denial of       Service condition. Furthermore, a remote attacker may be able to execute       arbitrary SQL commands, change parameter names for form inputs and make       changes to arbitrary records in the system, bypass intended access       restrictions, render arbitrary views, inject arbitrary web script or       HTML, or conduct cross-site request forgery (CSRF) attacks.
  Workaround :

    There is no known workaround at this time.

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-002 applied.  This update contains numerous security-related fixes for the following components :

  - CoreMedia Playback (10.7 only)
  - Directory Service (10.6 only)
  - OpenSSL
  - QuickDraw Manager
  - QuickTime
  - Ruby (10.6 only)
  - SMB (10.7 only)

ID	Name	Product	Family	Published	Updated	Severity
65751	Fedora 18 : rubygem-activesupport-3.2.8-3.fc18 (2013-4198)	Nessus	Fedora Local Security Checks	4/1/2013	1/11/2021	medium
65746	Fedora 17 : rubygem-activesupport-3.0.11-9.fc17 (2013-4130)	Nessus	Fedora Local Security Checks	4/1/2013	1/11/2021	medium
70590	Mac OS X : OS X Server < 3.0 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	10/24/2013	7/14/2018	high
65937	FreeBSD : rubygem-rails -- multiple vulnerabilities (db0c4b00-a24c-11e2-9601-000d601460a4)	Nessus	FreeBSD Local Security Checks	4/12/2013	1/6/2021	medium
79981	GLSA-201412-28 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	12/15/2014	1/6/2021	critical
66809	Mac OS X Multiple Vulnerabilities (Security Update 2013-002)	Nessus	MacOS X Local Security Checks	6/5/2013	11/27/2019	critical

Detections

Analytics

Plugins Search

medium

medium

high

medium

critical

critical