U radu programskog paketa ruby, za operacijske sustave Fedora 15 i 16, uočen je sigurnosni propust. Zlonamjerni ga korisnik može iskoristiti za izvođenje DoS napada.
Paket:
ruby 1.x
Operacijski sustavi:
Fedora 15, Fedora 16
Kritičnost:
6.8
Problem:
pogreška u programskoj funkciji
Iskorištavanje:
lokalno/udaljeno
Posljedica:
uskraćivanje usluga (DoS)
Rješenje:
programska zakrpa proizvođača
CVE:
CVE-2011-4815
Izvorni ID preporuke:
FEDORA-2011-17551
Izvor:
Fedora
Problem:
Propust je uzrokovan pogreškom u izračunu hash vrijednosti
Posljedica:
Napadač može iskoristiti ranjivost za izvođenje napada uskraćivanja usluge (DoS) podmetanjem posebno oblikovanih ulaznih podataka aplikaciji koja sprema hash tablicu.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-17551
2011-12-30 00:12:27
--------------------------------------------------------------------------------
Name : ruby
Product : Fedora 15
Version : 1.8.7.357
Release : 1.fc15
URL : http://www.ruby-lang.org/
Summary : An interpreter of object-oriented scripting language
Description :
Ruby is the interpreted scripting language for quick and easy
object-oriented programming. It has many features to process text
files and to do system management tasks (as in Perl). It is simple,
straight-forward, and extensible.
--------------------------------------------------------------------------------
Update Information:
A security flaw was found on the previous ruby that with some series of strings
which was specially crafted to intentionally collide their hash values with each
other, rails applications may fall into denial of services when such strings are
used in HTTP requests (CVE-2011-4815). This new ruby will fix this issue.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Dec 29 2011 Mamoru Tasaka <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.357-1
- Update to 1.8.7p357
- Randomize hash on process startup (CVE-2011-4815, bug 750564)
* Fri Dec 23 2011 Dennis Gilmore <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.352-2
- dont normalise arm cpus to arm
- there is something weird about how ruby choses where to put bits
* Wed Nov 16 2011 Mamoru Tasaka <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.352-3
- F-17: kill gdbm support for now due to licensing compatibility issue
* Sat Oct 1 2011 Mamoru Tasaka <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.352-2
- F-17: rebuild against new gdbm
* Sat Jul 16 2011 Mamoru Tasaka <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.352-1
- Update to 1.8.7 p352
- CVE-2011-2686 is fixed in this version (bug 722415)
- Update ext/tk to the latest git
- Remove duplicate path entry (bug 718695)
* Thu Jul 14 2011 Mamoru Tasaka <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.334-4
- Once fix FTBFS (bug 716021)
* Mon Jul 11 2011 Dennis Gilmore <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.334-3
- normalise arm cpus to arm
* Mon May 30 2011 Mamoru Tasaka <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.334-2
- Own %{_normalized_cpu}-%{_target_os} directory (bug 708816)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #750564 - CVE-2011-4815 ruby: hash table collisions CPU usage DoS
(oCERT-2011-003)
https://bugzilla.redhat.com/show_bug.cgi?id=750564
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update ruby' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2011-17542
2011-12-30 00:12:07
--------------------------------------------------------------------------------
Name : ruby
Product : Fedora 16
Version : 1.8.7.357
Release : 1.fc16
URL : http://www.ruby-lang.org/
Summary : An interpreter of object-oriented scripting language
Description :
Ruby is the interpreted scripting language for quick and easy
object-oriented programming. It has many features to process text
files and to do system management tasks (as in Perl). It is simple,
straight-forward, and extensible.
--------------------------------------------------------------------------------
Update Information:
A security flaw was found on the previous ruby that with some series of strings
which was specially crafted to intentionally collide their hash values with each
other, rails applications may fall into denial of services when such strings are
used in HTTP requests (CVE-2011-4815). This new ruby will fix this issue.
--------------------------------------------------------------------------------
ChangeLog:
* Thu Dec 29 2011 Mamoru Tasaka <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.357-1
- Update to 1.8.7p357
- Randomize hash on process startup (CVE-2011-4815, bug 750564)
* Fri Dec 23 2011 Dennis Gilmore <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.352-2
- dont normalise arm cpus to arm
- there is something weird about how ruby choses where to put bits
* Wed Nov 16 2011 Mamoru Tasaka <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.352-3
- F-17: kill gdbm support for now due to licensing compatibility issue
* Sat Oct 1 2011 Mamoru Tasaka <Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.> - 1.8.7.352-2
- F-17: rebuild against new gdbm
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #750564 - CVE-2011-4815 ruby: hash table collisions CPU usage DoS
(oCERT-2011-003)
https://bugzilla.redhat.com/show_bug.cgi?id=750564
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update ruby' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
Ova e-mail adresa je zaštićena od spambota. Potrebno je omogućiti JavaScript da je vidite.
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke