ID CVE-2018-8777
Summary In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x before 2.5.1, and 2.6.0-preview1, an attacker can pass a large HTTP request with a crafted header to WEBrick server or a crafted body to WEBrick server/handler and cause a denial of service (memory consumption).
References
Vulnerable Configurations
  • ruby-lang Ruby 2.2.0
    cpe:2.3:a:ruby-lang:ruby:2.2.0
  • Ruby-lang Ruby 2.2.0 Preview 1
    cpe:2.3:a:ruby-lang:ruby:2.2.0:preview1
  • Ruby-lang Ruby 2.2.0 Preview 2
    cpe:2.3:a:ruby-lang:ruby:2.2.0:preview2
  • Ruby-lang Ruby 2.2.0 Release Candidate 1
    cpe:2.3:a:ruby-lang:ruby:2.2.0:rc1
  • Ruby-lang Ruby 2.2.1
    cpe:2.3:a:ruby-lang:ruby:2.2.1
  • Ruby-lang Ruby 2.2.2
    cpe:2.3:a:ruby-lang:ruby:2.2.2
  • Ruby-lang Ruby 2.2.3
    cpe:2.3:a:ruby-lang:ruby:2.2.3
  • Ruby-lang Ruby 2.2.4
    cpe:2.3:a:ruby-lang:ruby:2.2.4
  • Ruby-lang Ruby 2.2.5
    cpe:2.3:a:ruby-lang:ruby:2.2.5
  • Ruby-lang Ruby 2.2.6
    cpe:2.3:a:ruby-lang:ruby:2.2.6
  • Ruby-lang Ruby 2.2.7
    cpe:2.3:a:ruby-lang:ruby:2.2.7
  • Ruby-lang Ruby 2.2.8
    cpe:2.3:a:ruby-lang:ruby:2.2.8
  • Ruby-lang Ruby 2.2.9
    cpe:2.3:a:ruby-lang:ruby:2.2.9
  • Ruby-lang Ruby 2.3.0
    cpe:2.3:a:ruby-lang:ruby:2.3.0
  • Ruby-lang Ruby 2.3.0 Preview 1
    cpe:2.3:a:ruby-lang:ruby:2.3.0:preview1
  • Ruby-lang Ruby 2.3.0 Preview 2
    cpe:2.3:a:ruby-lang:ruby:2.3.0:preview2
  • Ruby-lang Ruby 2.3.1
    cpe:2.3:a:ruby-lang:ruby:2.3.1
  • Ruby-lang Ruby 2.3.2
    cpe:2.3:a:ruby-lang:ruby:2.3.2
  • Ruby-lang Ruby 2.3.3
    cpe:2.3:a:ruby-lang:ruby:2.3.3
  • Ruby-lang Ruby 2.3.4
    cpe:2.3:a:ruby-lang:ruby:2.3.4
  • Ruby-lang Ruby 2.3.5
    cpe:2.3:a:ruby-lang:ruby:2.3.5
  • Ruby-lang Ruby 2.3.6
    cpe:2.3:a:ruby-lang:ruby:2.3.6
  • Ruby-lang Ruby 2.4.0
    cpe:2.3:a:ruby-lang:ruby:2.4.0
  • Ruby-lang Ruby 2.4.0 Preview 1
    cpe:2.3:a:ruby-lang:ruby:2.4.0:preview1
  • Ruby-lang Ruby 2.4.0 Preview 2
    cpe:2.3:a:ruby-lang:ruby:2.4.0:preview2
  • Ruby-lang Ruby 2.4.0 Preview 3
    cpe:2.3:a:ruby-lang:ruby:2.4.0:preview3
  • Ruby-lang Ruby 2.4.0 Release Candidate 1
    cpe:2.3:a:ruby-lang:ruby:2.4.0:rc1
  • Ruby-lang Ruby 2.4.1
    cpe:2.3:a:ruby-lang:ruby:2.4.1
  • Ruby-lang Ruby 2.4.2
    cpe:2.3:a:ruby-lang:ruby:2.4.2
  • Ruby-lang Ruby 2.4.3
    cpe:2.3:a:ruby-lang:ruby:2.4.3
  • Ruby-lang Ruby 2.5.0
    cpe:2.3:a:ruby-lang:ruby:2.5.0
  • Ruby-lang Ruby 2.5.0 Preview 1
    cpe:2.3:a:ruby-lang:ruby:2.5.0:preview1
  • Ruby-lang Ruby 2.6.0 Preview 1
    cpe:2.3:a:ruby-lang:ruby:2.6.0:preview1
  • Debian Linux 7.0
    cpe:2.3:o:debian:debian_linux:7.0
  • Debian Linux 8.0 (Jessie)
    cpe:2.3:o:debian:debian_linux:8.0
  • Debian Linux 9.0
    cpe:2.3:o:debian:debian_linux:9.0
  • Canonical Ubuntu Linux 14.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:14.04:-:-:-:lts
  • Canonical Ubuntu Linux 16.04 LTS (Long-Term Support)
    cpe:2.3:o:canonical:ubuntu_linux:16.04:-:-:-:lts
  • Canonical Ubuntu Linux 17.10
    cpe:2.3:o:canonical:ubuntu_linux:17.10
  • Red Hat Enterprise Linux 6.0
    cpe:2.3:o:redhat:enterprise_linux:6.0
  • Red Hat Enterprise Linux (RHEL) 7.0 (7)
    cpe:2.3:o:redhat:enterprise_linux:7.0
  • Red Hat Enterprise Linux 7.4
    cpe:2.3:o:redhat:enterprise_linux:7.4
  • Red Hat Enterprise Linux 7.5
    cpe:2.3:o:redhat:enterprise_linux:7.5
  • Red Hat Enterprise Linux 7.6
    cpe:2.3:o:redhat:enterprise_linux:7.6
CVSS
Base: 5.0
Impact:
Exploitability:
CWE CWE-400
CAPEC
  • XML Ping of the Death
    An attacker initiates a resource depletion attack where a large number of small XML messages are delivered at a sufficiently rapid rate to cause a denial of service or crash of the target. Transactions such as repetitive SOAP transactions can deplete resources faster than a simple flooding attack because of the additional resources used by the SOAP protocol and the resources necessary to process SOAP messages. The transactions used are immaterial as long as they cause resource utilization on the target. In other words, this is a normal flooding attack augmented by using messages that will require extra processing on the target.
  • XML Entity Expansion
    An attacker submits an XML document to a target application where the XML document uses nested entity expansion to produce an excessively large output XML. XML allows the definition of macro-like structures that can be used to simplify the creation of complex structures. However, this capability can be abused to create excessive demands on a processor's CPU and memory. A small number of nested expansions can result in an exponential growth in demands on memory.
  • Inducing Account Lockout
    An attacker leverages the security functionality of the system aimed at thwarting potential attacks to launch a denial of service attack against a legitimate system user. Many systems, for instance, implement a password throttling mechanism that locks an account after a certain number of incorrect log in attempts. An attacker can leverage this throttling mechanism to lock a legitimate user out of their own account. The weakness that is being leveraged by an attacker is the very security feature that has been put in place to counteract attacks.
  • Violating Implicit Assumptions Regarding XML Content (aka XML Denial of Service (XDoS))
    XML Denial of Service (XDoS) can be applied to any technology that utilizes XML data. This is, of course, most distributed systems technology including Java, .Net, databases, and so on. XDoS is most closely associated with web services, SOAP, and Rest, because remote service requesters can post malicious XML payloads to the service provider designed to exhaust the service provider's memory, CPU, and/or disk space. The main weakness in XDoS is that the service provider generally must inspect, parse, and validate the XML messages to determine routing, workflow, security considerations, and so on. It is exactly these inspection, parsing, and validation routines that XDoS targets. There are three primary attack vectors that XDoS can navigate Target CPU through recursion: attacker creates a recursive payload and sends to service provider Target memory through jumbo payloads: service provider uses DOM to parse XML. DOM creates in memory representation of XML document, but when document is very large (for example, north of 1 Gb) service provider host may exhaust memory trying to build memory objects. XML Ping of death: attack service provider with numerous small files that clog the system. All of the above attacks exploit the loosely coupled nature of web services, where the service provider has little to no control over the service requester and any messages the service requester sends.
nessus via4
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1421.NASL
    description Multiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2015-9096 SMTP command injection in Net::SMTP via CRLF sequences in a RCPT TO or MAIL FROM command. CVE-2016-2339 Exploitable heap overflow in Fiddle::Function.new. CVE-2016-7798 Incorrect handling of initialization vector in the GCM mode in the OpenSSL extension. CVE-2017-0898 Buffer underrun vulnerability in Kernel.sprintf. CVE-2017-0899 ANSI escape sequence vulnerability in RubyGems. CVE-2017-0900 DoS vulnerability in the RubyGems query command. CVE-2017-0901 gem installer allowed a malicious gem to overwrite arbitrary files. CVE-2017-0902 RubyGems DNS request hijacking vulnerability. CVE-2017-0903 Max Justicz reported that RubyGems is prone to an unsafe object deserialization vulnerability. When parsed by an application which processes gems, a specially crafted YAML formatted gem specification can lead to remote code execution. CVE-2017-10784 Yusuke Endoh discovered an escape sequence injection vulnerability in the Basic authentication of WEBrick. An attacker can take advantage of this flaw to inject malicious escape sequences to the WEBrick log and potentially execute control characters on the victim's terminal emulator when reading logs. CVE-2017-14033 asac reported a buffer underrun vulnerability in the OpenSSL extension. A remote attacker could take advantage of this flaw to cause the Ruby interpreter to crash leading to a denial of service. CVE-2017-14064 Heap memory disclosure in the JSON library. CVE-2017-17405 A command injection vulnerability in Net::FTP might allow a malicious FTP server to execute arbitrary commands. CVE-2017-17742 Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable to an HTTP response splitting vulnerability. It was possible for an attacker to inject fake HTTP responses if a script accepted an external input and output it without modifications. CVE-2017-17790 A command injection vulnerability in lib/resolv.rb's lazy_initialze might allow a command injection attack. However untrusted input to this function is rather unlikely. CVE-2018-6914 ooooooo_q discovered a directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library. It made it possible for attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. CVE-2018-8777 Eric Wong reported an out-of-memory DoS vulnerability related to a large request in WEBrick bundled with Ruby. CVE-2018-8778 aerodudrizzt found a buffer under-read vulnerability in the Ruby String#unpack method. If a big number was passed with the specifier @, the number was treated as a negative value, and an out-of-buffer read occurred. Attackers could read data on heaps if an script accepts an external input as the argument of String#unpack. CVE-2018-8779 ooooooo_q reported that the UNIXServer.open and UNIXSocket.open methods of the socket library bundled with Ruby did not check for NUL bytes in the path argument. The lack of check made the methods vulnerable to unintentional socket creation and unintentional socket access. CVE-2018-8780 ooooooo_q discovered an unintentional directory traversal in some methods in Dir, by the lack of checking for NUL bytes in their parameter. CVE-2018-1000075 A negative size vulnerability in ruby gem package tar header that could cause an infinite loop. CVE-2018-1000076 RubyGems package improperly verifies cryptographic signatures. A mis-signed gem could be installed if the tarball contains multiple gem signatures. CVE-2018-1000077 An improper input validation vulnerability in RubyGems specification homepage attribute could allow malicious gem to set an invalid homepage URL. CVE-2018-1000078 Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute. CVE-2018-1000079 Path Traversal vulnerability during gem installation. For Debian 8 'Jessie', these problems have been fixed in version 2.1.5-2+deb8u4. We recommend that you upgrade your ruby2.1 packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-08-08
    plugin id 111081
    published 2018-07-16
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111081
    title Debian DLA-1421-1 : ruby2.1 security update
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2018-005.NASL
    description The remote host is running Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities affecting the following components : - afpserver - AppleGraphicsControl - APR - ATS - CFNetwork - CoreAnimation - CoreCrypto - CoreFoundation - CUPS - Dictionary - dyld - Foundation - Heimdal - Hypervisor - ICU - Intel Graphics Driver - IOGraphics - IOHIDFamily - IOKit - IOUserEthernet - IPSec - Kernel - Login Window - mDNSOffloadUserClient - MediaRemote - Microcode - Perl - Ruby - Security - Spotlight - Symptom Framework - WiFi
    last seen 2019-02-21
    modified 2019-01-09
    plugin id 118573
    published 2018-10-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118573
    title macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-005)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_SECUPD2018-004.NASL
    description The remote host is running Mac OS X 10.11.6 or Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities.
    last seen 2019-02-21
    modified 2018-12-07
    plugin id 111136
    published 2018-07-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111136
    title macOS and Mac OS X Multiple Vulnerabilities (Security Update 2018-004)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1347.NASL
    description According to the version of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory.(CVE-2018-8777) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 118435
    published 2018-10-26
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=118435
    title EulerOS Virtualization 2.5.0 : ruby (EulerOS-SA-2018-1347)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-DD8162C004.NASL
    description - Rebase to Ruby 2.5.1. - Several CVE fixes. - Conflict requirement needs to generate dependency. - Stop using --with-setjmp-type=setjmp on aarch64. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-01-03
    plugin id 120846
    published 2019-01-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=120846
    title Fedora 28 : ruby (2018-dd8162c004)
  • NASL family Amazon Linux Local Security Checks
    NASL id ALA_ALAS-2018-983.NASL
    description Path traversal when writing to a symlinked basedir outside of the root RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in install_location function of package.rb that can result in path traversal when writing to a symlinked basedir outside of the root. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000073) Improper verification of signatures in tarball allows to install mis-signed gem : RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000076) Infinite loop vulnerability due to negative size in tar header causes Denial of Service RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000075) Command injection in lib/resolv.rb:lazy_initialize() allows arbitrary code execution : The 'lazy_initialize' function in lib/resolv.rb did not properly process certain filenames. A remote attacker could possibly exploit this flaw to inject and execute arbitrary commands. (CVE-2017-17790) Missing URL validation on spec home attribute allows malicious gem to set an invalid homepage URL : RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Input Validation vulnerability in ruby gems specification homepage attribute that can result in a malicious gem could set an invalid homepage URL. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000077) XSS vulnerability in homepage attribute when displayed via gem server RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute that can result in XSS. This attack appear to be exploitable via the victim must browse to a malicious gem on a vulnerable gem server. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000078) Unsafe Object Deserialization Vulnerability in gem owner allowing arbitrary code execution on specially crafted YAML RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Deserialization of Untrusted Data vulnerability in owner command that can result in code execution. This attack appear to be exploitable via victim must run the `gem owner` command on a gem with a specially crafted YAML file. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000074) Path traversal issue during gem installation allows to write to arbitrary filesystem locations RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Directory Traversal vulnerability in gem installation that can result in the gem could write to arbitrary filesystem locations during installation. This attack appear to be exploitable via the victim must install a malicious gem. This vulnerability appears to have been fixed in 2.7.6. (CVE-2018-1000079) If a script accepts an external input and outputs it without modification as a part of HTTP responses, an attacker can use newline characters to deceive the clients that the HTTP response header is stopped at there, and can inject fake HTTP responses after the newline characters to show malicious contents to the clients.(CVE-2017-17742) The Dir.mktmpdir method introduced by tmpdir library accepts the prefix and the suffix of the directory which is created as the first parameter. The prefix can contain relative directory specifiers '../', so this method can be used to target any directory. So, if a script accepts an external input as the prefix, and the targeted directory has inappropriate permissions or the ruby process has inappropriate privileges, the attacker can create a directory or a file at any directory.(CVE-2018-6914) If an attacker sends a large request which contains huge HTTP headers, WEBrick try to process it on memory, so the request causes the out-of-memory DoS attack.(CVE-2018-8777) String#unpack receives format specifiers as its parameter, and can be specified the position of parsing the data by the specifier @. If a big number is passed with @, the number is treated as the negative value, and out-of-buffer read is occurred. So, if a script accepts an external input as the argument of String#unpack, the attacker can read data on heaps.(CVE-2018-8778) UNIXServer.open accepts the path of the socket to be created at the first parameter. If the path contains NUL (\0) bytes, this method recognize that the path is completed before the NUL bytes. So, if a script accepts an external input as the argument of this method, the attacker can make the socket file in the unintentional path. And, UNIXSocket.open also accepts the path of the socket to be created at the first parameter without checking NUL bytes like UNIXServer.open. So, if a script accepts an external input as the argument of this method, the attacker can accepts the socket file in the unintentional path.(CVE-2018-8779) Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the target directory as their parameter. If the parameter contains NUL (\0) bytes, these methods recognize that the path is completed before the NUL bytes. So, if a script accepts an external input as the argument of these methods, the attacker can make the unintentional directory traversal.(CVE-2018-8780)
    last seen 2019-02-21
    modified 2018-05-11
    plugin id 108846
    published 2018-04-06
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108846
    title Amazon Linux AMI : ruby20 / ruby22,ruby23,ruby24 (ALAS-2018-983)
  • NASL family MacOS X Local Security Checks
    NASL id MACOS_10_13_6.NASL
    description The remote host is running a version of macOS / Mac OS X that is 10.13.x prior to 10.13.6. It is, therefore, affected by multiple vulnerabilities. Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen 2019-02-21
    modified 2018-12-07
    plugin id 111137
    published 2018-07-17
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111137
    title macOS 10.13.x < 10.13.6 Multiple Vulnerabilities
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1358.NASL
    description Multiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2017-17742 Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable to an HTTP response splitting vulnerability. It was possible for an attacker to inject fake HTTP responses if a script accepted an external input and output it without modifications. CVE-2018-6914 ooooooo_q discovered a directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library. It made it possible for attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. CVE-2018-8777 Eric Wong reported an out-of-memory DoS vulnerability related to a large request in WEBrick bundled with Ruby. CVE-2018-8778 aerodudrizzt found a buffer under-read vulnerability in the Ruby String#unpack method. If a big number was passed with the specifier @, the number was treated as a negative value, and an out-of-buffer read occurred. Attackers could read data on heaps if an script accepts an external input as the argument of String#unpack. CVE-2018-8779 ooooooo_q reported that the UNIXServer.open and UNIXSocket.open methods of the socket library bundled with Ruby did not check for NUL bytes in the path argument. The lack of check made the methods vulnerable to unintentional socket creation and unintentional socket access. CVE-2018-8780 ooooooo_q discovered an unintentional directory traversal in some methods in Dir, by the lack of checking for NUL bytes in their parameter. CVE-2018-1000075 A negative size vulnerability in ruby gem package tar header that could cause an infinite loop. CVE-2018-1000076 Ruby gems package improperly verifies cryptographic signatures. A mis-signed gem could be installed if the tarball contains multiple gem signatures. CVE-2018-1000077 An improper input validation vulnerability in ruby gems specification homepage attribute could allow malicious gem to set an invalid homepage URL. CVE-2018-1000078 Cross Site Scripting (XSS) vulnerability in gem server display of homepage attribute For Debian 7 'Wheezy', these problems have been fixed in version 1.9.3.194-8.1+deb7u8. We recommend that you upgrade your ruby1.9.1 packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-08-31
    plugin id 109283
    published 2018-04-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109283
    title Debian DLA-1358-1 : ruby1.9.1 security update
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1206.NASL
    description According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory.(CVE-2018-6914) - A integer underflow was found in the way String#unpack decodes the unpacking format. An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application's memory.(CVE-2018-8778) - It was found that the UNIXSocket::open and UNIXServer::open ruby methods did not handle the NULL byte properly. An attacker, able to inject NULL bytes in the socket path, could possibly trigger an unspecified behavior of the ruby script.(CVE-2018-8779) - It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script.(CVE-2018-8780) - It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory.(CVE-2018-8777) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 110870
    published 2018-07-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110870
    title EulerOS 2.0 SP2 : ruby (EulerOS-SA-2018-1206)
  • NASL family Slackware Local Security Checks
    NASL id SLACKWARE_SSA_2018-088-01.NASL
    description New ruby packages are available for Slackware 14.2 and -current to fix security issues.
    last seen 2019-02-21
    modified 2018-09-04
    plugin id 108725
    published 2018-03-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108725
    title Slackware 14.2 / current : ruby (SSA:2018-088-01)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2018-A459ACD54B.NASL
    description Backport `rubygem.macros` changes. Enables maintaners to build rubygems using same macros in all Fedoras. ---- Rebase to Ruby 2.4.4. Includes several CVE fixes. https://www.ruby-lang.org/en/news/2018/03/28/ruby-2-4-4-released/ Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-09-05
    plugin id 110389
    published 2018-06-07
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110389
    title Fedora 27 : ruby (2018-a459acd54b)
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1207.NASL
    description According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory.(CVE-2018-6914) - A integer underflow was found in the way String#unpack decodes the unpacking format. An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application's memory.(CVE-2018-8778) - It was found that the UNIXSocket::open and UNIXServer::open ruby methods did not handle the NULL byte properly. An attacker, able to inject NULL bytes in the socket path, could possibly trigger an unspecified behavior of the ruby script.(CVE-2018-8779) - It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script.(CVE-2018-8780) - It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory.(CVE-2018-8777) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a infinite loop caused by negative size vulnerability in ruby gem package tar header that can result in a negative size could cause an infinite loop.. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000075) - RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: 2.3.6 and earlier, Ruby 2.4 series: 2.4.3 and earlier, Ruby 2.5 series: 2.5.0 and earlier, prior to trunk revision 62422 contains a Improper Verification of Cryptographic Signature vulnerability in package.rb that can result in a mis-signed gem could be installed, as the tarball would contain multiple gem signatures.. This vulnerability appears to have been fixed in 2.7.6.(CVE-2018-1000076) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2019-02-19
    plugin id 110871
    published 2018-07-03
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110871
    title EulerOS 2.0 SP3 : ruby (EulerOS-SA-2018-1207)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-4259.NASL
    description Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in incorrect processing of HTTP/FTP, directory traversal, command injection, unintended socket creation or information disclosure. This update also fixes several issues in RubyGems which could allow an attacker to use specially crafted gem files to mount cross-site scripting attacks, cause denial of service through an infinite loop, write arbitrary files, or run malicious code.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 111468
    published 2018-08-02
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=111468
    title Debian DSA-4259-1 : ruby2.3 - security update
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DLA-1359.NASL
    description Multiple vulnerabilities were found in the interpreter for the Ruby language. The Common Vulnerabilities and Exposures project identifies the following issues : CVE-2017-17742 Aaron Patterson reported that WEBrick bundled with Ruby was vulnerable to an HTTP response splitting vulnerability. It was possible for an attacker to inject fake HTTP responses if a script accepted an external input and output it without modifications. CVE-2018-6914 ooooooo_q discovered a directory traversal vulnerability in the Dir.mktmpdir method in the tmpdir library. It made it possible for attackers to create arbitrary directories or files via a .. (dot dot) in the prefix argument. CVE-2018-8777 Eric Wong reported an out-of-memory DoS vulnerability related to a large request in WEBrick bundled with Ruby. CVE-2018-8778 aerodudrizzt found a buffer under-read vulnerability in the Ruby String#unpack method. If a big number was passed with the specifier @, the number was treated as a negative value, and an out-of-buffer read occurred. Attackers could read data on heaps if an script accepts an external input as the argument of String#unpack. CVE-2018-8779 ooooooo_q reported that the UNIXServer.open and UNIXSocket.open methods of the socket library bundled with Ruby did not check for NUL bytes in the path argument. The lack of check made the methods vulnerable to unintentional socket creation and unintentional socket access. CVE-2018-8780 ooooooo_q discovered an unintentional directory traversal in some methods in Dir, by the lack of checking for NUL bytes in their parameter. For Debian 7 'Wheezy', these problems have been fixed in version 1.8.7.358-7.1+deb7u6. We recommend that you upgrade your ruby1.8 packages. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-08-31
    plugin id 109284
    published 2018-04-24
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=109284
    title Debian DLA-1359-1 : ruby1.8 security update
  • NASL family Huawei Local Security Checks
    NASL id EULEROS_SA-2018-1275.NASL
    description According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - It was found that the tmpdir and tempfile modules did not sanitize their file name argument. An attacker with control over the name could create temporary files and directories outside of the dedicated directory.(CVE-2018-6914) - A integer underflow was found in the way String#unpack decodes the unpacking format. An attacker, able to control the unpack format, could use this flaw to disclose arbitrary parts of the application's memory.(CVE-2018-8778) - It was found that the UNIXSocket::open and UNIXServer::open ruby methods did not handle the NULL byte properly. An attacker, able to inject NULL bytes in the socket path, could possibly trigger an unspecified behavior of the ruby script.(CVE-2018-8779) - It was found that the methods from the Dir class did not properly handle strings containing the NULL byte. An attacker, able to inject NULL bytes in a path, could possibly trigger an unspecified behavior of the ruby script.(CVE-2018-8780) - It was found that WEBrick could be forced to use an excessive amount of memory during the processing of HTTP requests, leading to a Denial of Service. An attacker could use this flaw to send huge requests to a WEBrick application, resulting in the server running out of memory.(CVE-2018-8777) Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-11-13
    plugin id 117584
    published 2018-09-18
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=117584
    title EulerOS Virtualization 2.5.1 : ruby (EulerOS-SA-2018-1275)
  • NASL family FreeBSD Local Security Checks
    NASL id FREEBSD_PKG_EB69BCF218EF4AA2BB0C83B263364089.NASL
    description Ruby news : CVE-2017-17742: HTTP response splitting in WEBrick If a script accepts an external input and outputs it without modification as a part of HTTP responses, an attacker can use newline characters to deceive the clients that the HTTP response header is stopped at there, and can inject fake HTTP responses after the newline characters to show malicious contents to the clients. CVE-2018-6914: Unintentional file and directory creation with directory traversal in tempfile and tmpdir Dir.mktmpdir method introduced by tmpdir library accepts the prefix and the suffix of the directory which is created as the first parameter. The prefix can contain relative directory specifiers '../', so this method can be used to target any directory. So, if a script accepts an external input as the prefix, and the targeted directory has inappropriate permissions or the ruby process has inappropriate privileges, the attacker can create a directory or a file at any directory. CVE-2018-8777: DoS by large request in WEBrick If an attacker sends a large request which contains huge HTTP headers, WEBrick try to process it on memory, so the request causes the out-of-memory DoS attack. CVE-2018-8778: Buffer under-read in String#unpack String#unpack receives format specifiers as its parameter, and can be specified the position of parsing the data by the specifier @. If a big number is passed with @, the number is treated as the negative value, and out-of-buffer read is occurred. So, if a script accepts an external input as the argument of String#unpack, the attacker can read data on heaps. CVE-2018-8779: Unintentional socket creation by poisoned NUL byte in UNIXServer and UNIXSocket UNIXServer.open accepts the path of the socket to be created at the first parameter. If the path contains NUL (\0) bytes, this method recognize that the path is completed before the NUL bytes. So, if a script accepts an external input as the argument of this method, the attacker can make the socket file in the unintentional path. And, UNIXSocket.open also accepts the path of the socket to be created at the first parameter without checking NUL bytes like UNIXServer.open. So, if a script accepts an external input as the argument of this method, the attacker can accepts the socket file in the unintentional path. CVE-2018-8780: Unintentional directory traversal by poisoned NUL byte in Dir Dir.open, Dir.new, Dir.entries and Dir.empty? accept the path of the target directory as their parameter. If the parameter contains NUL (\0) bytes, these methods recognize that the path is completed before the NUL bytes. So, if a script accepts an external input as the argument of these methods, the attacker can make the unintentional directory traversal.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 108739
    published 2018-03-30
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=108739
    title FreeBSD : ruby -- multiple vulnerabilities (eb69bcf2-18ef-4aa2-bb0c-83b263364089)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-3685-1.NASL
    description Some of these CVE were already addressed in previous USN: 3439-1, 3553-1, 3528-1. Here we address for the remain releases. It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to cause a buffer overrun. (CVE-2017-0898) It was discovered that Ruby incorrectly handled certain files. An attacker could use this to overwrite any file on the filesystem. (CVE-2017-0901) It was discovered that Ruby was vulnerable to a DNS hijacking vulnerability. An attacker could use this to possibly force the RubyGems client to download and install gems from a server that the attacker controls. (CVE-2017-0902) It was discovered that Ruby incorrectly handled certain YAML files. An attacker could use this to possibly execute arbitrary code. (CVE-2017-0903) It was discovered that Ruby incorrectly handled certain files. An attacker could use this to expose sensitive information. (CVE-2017-14064) It was discovered that Ruby incorrectly handled certain inputs. An attacker could use this to execute arbitrary code. (CVE-2017-10784) It was discovered that Ruby incorrectly handled certain network requests. An attacker could possibly use this to inject a crafted key into a HTTP response. (CVE-2017-17742) It was discovered that Ruby incorrectly handled certain files. An attacker could possibly use this to execute arbitrary code. This update is only addressed to ruby2.0. (CVE-2018-1000074) It was discovered that Ruby incorrectly handled certain network requests. An attacker could possibly use this to cause a denial of service. (CVE-2018-8777). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 110551
    published 2018-06-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=110551
    title Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : ruby1.9.1, ruby2.0, ruby2.3 vulnerabilities (USN-3685-1)
redhat via4
advisories
  • rhsa
    id RHSA-2018:3729
  • rhsa
    id RHSA-2018:3730
  • rhsa
    id RHSA-2018:3731
refmap via4
bid 103683
confirm
debian DSA-4259
mlist
  • [debian-lts-announce] 20180423 [SECURITY] [DLA 1358-1] ruby1.9.1 security update
  • [debian-lts-announce] 20180423 [SECURITY] [DLA 1359-1] ruby1.8 security update
  • [debian-lts-announce] 20180714 [SECURITY] [DLA 1421-1] ruby2.1 security update
sectrack 1042004
ubuntu USN-3685-1
Last major update 03-04-2018 - 18:29
Published 03-04-2018 - 18:29
Last modified 21-07-2019 - 08:15
Back to Top