PT-2011-4036 · Ruby+2 · Ruby+2

Huzaifa S. Sidhpurwala · Published 2011-08-05 · Updated 2012-01-19 · CVE-2011-2705

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ruby versions prior to 1.8.7-p352 Ruby versions 1.9.x prior to 1.9.2-p290

Description The issue concerns the SecureRandom.random bytes function in Ruby, which relies on PID values for initialization. This reliance makes it easier for attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID.

Recommendations For Ruby versions prior to 1.8.7-p352, update to version 1.8.7-p352 or later. For Ruby versions 1.9.x prior to 1.9.2-p290, update to version 1.9.2-p290 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-2705

DLA-235-1

DLA-88-1

RHSA-2011:1581

RHSA-2011_1581

RHSA-2026:7305

RHSA-2026:7307

RHSA-2026:8838

Affected Products

Red Hat

Ruby

Suse

References · 17

• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/07/12/14 · Patch
• http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050 · Patch
• https://linux.oracle.com/errata/ELSA-2011-1581.html · Vendor Advisory
• http://ruby-lang.org/en/news/2011/07/15/ruby-1-9-2-p290-is-released · Patch
• http://ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released · Patch
• http://openwall.com/lists/oss-security/2011/07/20/1 · Patch
• http://openwall.com/lists/oss-security/2011/07/20/16 · Patch
• http://openwall.com/lists/oss-security/2011/07/11/1 · Patch
• http://redhat.com/support/errata/RHSA-2011-1581.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=722415 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2011-2705 · Security Note
• http://svn.ruby-lang.org/repos/ruby/tags/v1_8_7_352/ChangeLog · Note
• http://redmine.ruby-lang.org/issues/4579 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html · Vendor Advisory, Patch