PT-2011-4036 · Ruby+2 · Ruby+2

Huzaifa S. Sidhpurwala · Publicado 2011-08-05 · Atualizado 2012-01-19 · CVE-2011-2705

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 1.8.7-p352 Ruby versions 1.9.x prior to 1.9.2-p290

Description The issue concerns the SecureRandom.random bytes function in Ruby, which relies on PID values for initialization. This reliance makes it easier for attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

Recommendations For Ruby versions prior to 1.8.7-p352, update to version 1.8.7-p352 or later. For Ruby versions 1.9.x prior to 1.9.2-p290, update to version 1.9.2-p290 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-2705

DLA-235-1

DLA-88-1

RHSA-2011:1581

RHSA-2011_1581

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

Produtos afetados

Red Hat

Ruby

Suse

Referências · 17

• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html · Aviso do Fabricante
• http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog · Nota
• http://redmine.ruby-lang.org/issues/4579 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html · Aviso do Fabricante, Correção
• http://openwall.com/lists/oss-security/2011/07/12/14 · Correção
• http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050 · Correção
• https://linux.oracle.com/errata/ELSA-2011-1581.html · Aviso do Fabricante
• http://ruby-lang.org/en/news/2011/07/15/ruby-1-9-2-p290-is-released · Correção
• http://ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released · Correção
• http://openwall.com/lists/oss-security/2011/07/20/1 · Correção
• http://openwall.com/lists/oss-security/2011/07/20/16 · Correção
• http://securityfocus.com/bid/49015 · Nota
• http://openwall.com/lists/oss-security/2011/07/11/1 · Correção
• http://svn.ruby-lang.org/repos/ruby/tags/v1_9_2_290/ChangeLog · Nota
• http://redhat.com/support/errata/RHSA-2011-1581.html · Aviso do Fabricante