ruby-1.8.5-5.5
エラータID: AXSA:2008-471:02
リリース日:
2008/11/11 Tuesday - 15:59
題名:
ruby-1.8.5-5.5
影響のあるチャネル:
Asianux Server 3 for x86
Asianux Server 3 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Ruby の regex.c に脆弱性が発見されました。リモートの攻撃者は、Rubyのソケットに対して複数の長いリクエストを用いて、無限ループやクラッシュなどのサービス運用妨害 (DoS)を引き起こす可能性があります。(CVE-2008-3443)
- Ruby のセーフレベル制限に複数の脆弱性が発見されました。攻撃者は、セーフレベル4で(1) untrace_var、(2) $PROGRAM_NAME、(3) syslog を実行したり、セーフレベル1から3で安全ではないメソッドを呼び出すことで、アクセス制限を回避する可能性があります。(CVE-2008-3655)
- WEBricの処理に脆弱性が発見されました。攻撃者は巧妙なHTTPリクエストを用いてCPU資源を大量消費させるサービス運用妨害 (DoS)を引き起こす可能性があります。(CVE-2008-3656)
- dl モジュール に汚染チェックの欠如が発見されました。攻撃者は、セーフレベルを回避し、DL.dlopen を使用してライブラリにアクセスすることで、危険な関数を実行する可能性があります。(CVE-2008-3657)
- REXML モジュールに脆弱性が発見されました。攻撃者は、XML entity explosion attackと呼ばれる手法を用いて、CPU資源を大量消費させるサービス運用妨害 (DoS)を引き起こす可能性があります。(CVE-2008-3790)
- resolv.rb はDNSリクエスト時に、シーケンシャルなトランザクション ID と固定ソースポートを用いているため、リモートの攻撃者はDNSスプーフィングを行う可能性があります。これは CVE-2008-1447 とは異なる脆弱性です。 (CVE-2008-3905)
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2008-3443
The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.
The regular expression engine (regex.c) in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows remote attackers to cause a denial of service (infinite loop and crash) via multiple long requests to a Ruby socket, related to memory allocation failure, and as demonstrated against Webrick.
CVE-2008-3655
Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.
Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3.
CVE-2008-3656
Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.
Algorithmic complexity vulnerability in the WEBrick::HTTPUtils.split_header_value function in WEBrick::HTTP::DefaultFileHandler in WEBrick in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 allows context-dependent attackers to cause a denial of service (CPU consumption) via a crafted HTTP request that is processed by a backtracking regular expression.
CVE-2008-3657
The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen.
The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check "taintness" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen.
CVE-2008-3790
The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."
The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an "XML entity explosion."
CVE-2008-3905
resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447.
追加情報:
N/A
ダウンロード:
Asianux Server 3 for x86
- ruby-1.8.5-5.5.i386.rpm
MD5: 9c25d99ffec80598d81b7940bb8b4a89
SHA-256: ec5346812b43146b4edbaebb162c9d411614c6e7c7bbd142cb6b9e6db9ede435
Size: 282.89 kB - ruby-devel-1.8.5-5.5.i386.rpm
MD5: 8dd631850e89b9a7bdf5719f100437e2
SHA-256: 5723e6ff29b280068c6dc86a5f5bfa0ef70eb3144556ada02e5543633301d233
Size: 549.16 kB - ruby-docs-1.8.5-5.5.i386.rpm
MD5: 4610b0481c820e50aad5d004905af815
SHA-256: 1ac0e7f4b89c70f4cba24be4f5d9847fe0b3f788efebdc1c505d2f2586982d79
Size: 1.50 MB - ruby-irb-1.8.5-5.5.i386.rpm
MD5: ab64609244880fde18b1673f144baa72
SHA-256: 95ce8d180970831a466940d7ff9353eea3b97aeb2930e8e256b892bde92d0b0c
Size: 69.45 kB - ruby-libs-1.8.5-5.5.i386.rpm
MD5: 7636c76e94b6bfba7903f671b9c89fa1
SHA-256: 2e3bec7d4be4ed8d372534b1a1658e6862b16c85ecb69af11b73ab3cb495d7fc
Size: 1.64 MB - ruby-mode-1.8.5-5.5.i386.rpm
MD5: 73a2e3528b098ff5b81c770c96c0493e
SHA-256: c63bbaeac74913fb0d87acb9ab5bd141ce1cb7b609417c181f1b83d9f33f8990
Size: 54.11 kB - ruby-tcltk-1.8.5-5.5.i386.rpm
MD5: e55f3706423746dc4c385e9104309aff
SHA-256: 13f3afa9a4229386d4e2fb3495fbb4ad5315d9b8c3a85826450176b913c2e97c
Size: 1.67 MB
Asianux Server 3 for x86_64
- ruby-1.8.5-5.5.x86_64.rpm
MD5: a0ac4a18d4af05a524e59130d3655dc5
SHA-256: f4a23c80f91053a657cb3ade5b2b1ca9beb04dfc443b0f312b09467c0730e7c2
Size: 283.30 kB - ruby-devel-1.8.5-5.5.x86_64.rpm
MD5: 29b3692fd974eae33d0366af9f5f90ba
SHA-256: 0adb544c21cc4c78abb091b536ad0e3887b3f22f94f162d3bca4c7c5f452bb33
Size: 557.21 kB - ruby-docs-1.8.5-5.5.x86_64.rpm
MD5: 7796d19bcdd654d72b8e87995b64aa96
SHA-256: 716b16dbd6c8569798d8b6dcbb62b7022b6356b1c5a81a275ff86d7c2fe3b44b
Size: 1.50 MB - ruby-irb-1.8.5-5.5.x86_64.rpm
MD5: 383da243ed6e24bdf143b4aeeac077be
SHA-256: f267c393d08fa569e568d6d5a2b45fdc4fd075d4cf5b8b878b493482f7a4c21f
Size: 69.34 kB - ruby-libs-1.8.5-5.5.x86_64.rpm
MD5: f281e69641099a8a98123d0a33a09ad2
SHA-256: aafb64bbdd0cf4bf82cac0fc0c573f746a4b5f9fbe00e7b808d96d535fa80e53
Size: 1.65 MB - ruby-mode-1.8.5-5.5.x86_64.rpm
MD5: e05ce6a2f96e4694232937508d579bdb
SHA-256: 282a51c17d55a01530c2e7ff68b4fd335c07794447e94a5c03f231f9d9458b40
Size: 54.18 kB - ruby-tcltk-1.8.5-5.5.x86_64.rpm
MD5: 7b3c1d6d9f7c59531ccf7df9c2ec0382
SHA-256: 225aac1b40ff4be718026fbd43d7ecf40b26830dcda8f78f07d978c1ccfe8808
Size: 1.67 MB