PT-2007-6737 · Ruby+1 · Ruby+1

Published 2007-11-13 · Updated 2017-09-29 · CVE-2007-5770

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions 1.8.5 through 1.8.6

Description The issue concerns the Net::ftptls, Net::telnets, Net::imap, Net::pop, and Net::smtp libraries in Ruby, which do not verify that the commonName (CN) field in a server certificate matches the domain name in a request sent over SSL. This makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.

Recommendations For Ruby versions 1.8.5 through 1.8.6, consider updating to a version that includes a fix for this issue, as the current versions do not properly verify server certificates. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2007-5770

DSA-1410-1

DSA-1411-1

DSA-1412-1

RHSA-2007:0961

RHSA-2007:0965

RHSA-2007_0961

RHSA-2007_0965

Affected Products

Red Hat

Ruby

References · 34

• http://secunia.com/advisories/27576 · Vendor Advisory
• http://ubuntu.com/usn/usn-596-1 · Vendor Advisory
• http://secunia.com/advisories/26985 · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2007-0961.html · Vendor Advisory
• http://debian.org/security/2007/dsa-1411 · Vendor Advisory
• http://debian.org/security/2007/dsa-1410 · Vendor Advisory
• http://secunia.com/advisories/27673 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-5770 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2008:029 · Vendor Advisory
• http://debian.org/security/2007/dsa-1412 · Vendor Advisory
• http://novell.com/linux/security/advisories/2007_24_sr.html · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html · Vendor Advisory
• http://secunia.com/advisories/28645 · Note
• http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656 · Note
• http://secunia.com/advisories/27764 · Note