PT-2009-3283 · Ruby+1 · Ruby+1

Kurt Roeckx · Published 2009-02-18 · Updated 2017-09-29 · CVE-2009-0642

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ruby versions 1.8 and 1.9

Description The issue is related to the improper checking of the return value from the OCSP basic verify function in the ext/openssl/ossl ocsp.c file. This could allow remote attackers to present an invalid X.509 certificate, possibly involving a revoked certificate.

Recommendations For Ruby version 1.8, update to a version that properly checks the return value from the OCSP basic verify function. For Ruby version 1.9, update to a version that properly checks the return value from the OCSP basic verify function.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-0642

DSA-1860-1

RHSA-2009:1140

RHSA-2009_1140

Affected Products

Red Hat

Ruby

References · 20

• 🔥 http://redmine.ruby-lang.org/issues/show/1091 · Exploit
• http://redhat.com/support/errata/RHSA-2009-1140.html · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:193 · Vendor Advisory
• http://ubuntu.com/usn/USN-805-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-0642 · Security Note
• https://github.com/NZKoz/bigdecimal-segfault-fix · Note
• http://redmine.ruby-lang.org/issues/show/794 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=513528 · Note
• http://secunia.com/advisories/35699 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11450 · Note
• http://securitytracker.com/id?1022505 · Note
• https://access.redhat.com/security/cve/CVE-2009-1904 · Note
• https://access.redhat.com/errata/RHSA-2009:1140 · Note
• https://access.redhat.com/security/cve/CVE-2009-0642 · Note
• http://secunia.com/advisories/35937 · Note