PT-2009-3283 · Ruby+1 · Ruby+1

Kurt Roeckx · Publicado 2009-02-18 · Atualizado 2017-09-29 · CVE-2009-0642

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ruby versions 1.8 and 1.9

Description The issue is related to the improper checking of the return value from the OCSP basic verify function in the ext/openssl/ossl ocsp.c file. This could allow remote attackers to present an invalid X.509 certificate, possibly involving a revoked certificate.

Recommendations For Ruby version 1.8, update to a version that properly checks the return value from the OCSP basic verify function. For Ruby version 1.9, update to a version that properly checks the return value from the OCSP basic verify function.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-0642

DSA-1860-1

RHSA-2009:1140

RHSA-2009_1140

Produtos afetados

Red Hat

Ruby

Referências · 20

• 🔥 http://redmine.ruby-lang.org/issues/show/1091 · Exploit
• https://github.com/NZKoz/bigdecimal-segfault-fix · Nota
• http://redmine.ruby-lang.org/issues/show/794 · Nota
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513528 · Nota
• http://secunia.com/advisories/35699 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11450 · Nota
• http://securitytracker.com/id?1022505 · Nota
• http://redhat.com/support/errata/RHSA-2009-1140.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2009-1904 · Nota
• https://access.redhat.com/errata/RHSA-2009:1140 · Nota
• https://access.redhat.com/security/cve/CVE-2009-0642 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2009:193 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-805-1 · Aviso do Fabricante
• http://secunia.com/advisories/35937 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48761 · Nota