Red Hat Product Errata RHSA-2005:799 - Security Advisory
Issued:
2005-10-11
Updated:
2005-10-25

RHSA-2005:799 - Security Advisory

Synopsis

ruby security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated ruby packages that fix an arbitrary command execution issue are now
available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

[Updated 25 Oct 2005]
Errata has been updated to include missing packages for Red Hat Enterprise
Linux 3.

Description

Ruby is an interpreted scripting language for object-oriented programming.

A bug was found in the way ruby handles eval statements. It is possible for
a malicious script to call eval in such a way that can allow the bypass of
certain safe-level restrictions. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2005-2337 to this issue.

Users of Ruby should update to these erratum packages, which contain a
backported patch and are not vulnerable to this issue.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server 3 x86_64
  • Red Hat Enterprise Linux Server 3 ia64
  • Red Hat Enterprise Linux Server 3 i386
  • Red Hat Enterprise Linux Server 2 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Workstation 3 x86_64
  • Red Hat Enterprise Linux Workstation 3 ia64
  • Red Hat Enterprise Linux Workstation 3 i386
  • Red Hat Enterprise Linux Workstation 2 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux Desktop 3 x86_64
  • Red Hat Enterprise Linux Desktop 3 i386
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems 3 s390x
  • Red Hat Enterprise Linux for IBM z Systems 3 s390
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian 3 ppc

Fixes

  • BZ - 169575 - CAN-2005-2337 ruby safe-level mode bypass

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
x86_64
irb-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 8350c1bc9fefbfc5527d24ce7b269047651447a887fb95cdbe037b0abc28c2a1
irb-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 8350c1bc9fefbfc5527d24ce7b269047651447a887fb95cdbe037b0abc28c2a1
ruby-1.8.1-7.EL4.2.x86_64.rpm SHA-256: dd2e4beee93024f71a802aab4c990f01ede78c4f7ec57e2d593a7fca9a99762e
ruby-1.8.1-7.EL4.2.x86_64.rpm SHA-256: dd2e4beee93024f71a802aab4c990f01ede78c4f7ec57e2d593a7fca9a99762e
ruby-devel-1.8.1-7.EL4.2.x86_64.rpm SHA-256: c4b3aad16d380da3b087374fd6e0fab5eb1be69bfff7d1692be2342fe725fb73
ruby-devel-1.8.1-7.EL4.2.x86_64.rpm SHA-256: c4b3aad16d380da3b087374fd6e0fab5eb1be69bfff7d1692be2342fe725fb73
ruby-docs-1.8.1-7.EL4.2.x86_64.rpm SHA-256: f83ae2d3292daa5d0ad134daecbb30408e93cd8e9635210731c28fe03c4a9596
ruby-docs-1.8.1-7.EL4.2.x86_64.rpm SHA-256: f83ae2d3292daa5d0ad134daecbb30408e93cd8e9635210731c28fe03c4a9596
ruby-libs-1.8.1-7.EL4.2.i386.rpm SHA-256: 3470949e3b1f3508565ceef8dda5736c56a6216b743cf1f9e99920ee15e3fd17
ruby-libs-1.8.1-7.EL4.2.i386.rpm SHA-256: 3470949e3b1f3508565ceef8dda5736c56a6216b743cf1f9e99920ee15e3fd17
ruby-libs-1.8.1-7.EL4.2.x86_64.rpm SHA-256: e3d4faeb73462c90bb5a5f5234dfcb1a612ffb3b63e7a12ee17682f81724b6af
ruby-libs-1.8.1-7.EL4.2.x86_64.rpm SHA-256: e3d4faeb73462c90bb5a5f5234dfcb1a612ffb3b63e7a12ee17682f81724b6af
ruby-mode-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 41617cdf15e653951c470fabcf1d405bf6a48b5b2b07171db3b439628d363d52
ruby-mode-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 41617cdf15e653951c470fabcf1d405bf6a48b5b2b07171db3b439628d363d52
ruby-tcltk-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 4adfa00c9d18719c5b2bf6313fe12687f3935606c334834c6384923acd189688
ruby-tcltk-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 4adfa00c9d18719c5b2bf6313fe12687f3935606c334834c6384923acd189688
ia64
irb-1.8.1-7.EL4.2.ia64.rpm SHA-256: ebf632c4511e708c9478e933ec86fa62221025dfc74b755a1584081720dc0366
irb-1.8.1-7.EL4.2.ia64.rpm SHA-256: ebf632c4511e708c9478e933ec86fa62221025dfc74b755a1584081720dc0366
ruby-1.8.1-7.EL4.2.ia64.rpm SHA-256: fb0992a67567cacd635da0e915dc1145b521b9fa158872368867bf252883635a
ruby-1.8.1-7.EL4.2.ia64.rpm SHA-256: fb0992a67567cacd635da0e915dc1145b521b9fa158872368867bf252883635a
ruby-devel-1.8.1-7.EL4.2.ia64.rpm SHA-256: e81a263766c4eb94815a6855a2fc7edca5162da01eb6456fdcc7a13aae7b61d6
ruby-devel-1.8.1-7.EL4.2.ia64.rpm SHA-256: e81a263766c4eb94815a6855a2fc7edca5162da01eb6456fdcc7a13aae7b61d6
ruby-docs-1.8.1-7.EL4.2.ia64.rpm SHA-256: 1008bd0e242c9e2cdbf3f98790859d4652f4f97a5f4577a0e7bdf7a72f0116da
ruby-docs-1.8.1-7.EL4.2.ia64.rpm SHA-256: 1008bd0e242c9e2cdbf3f98790859d4652f4f97a5f4577a0e7bdf7a72f0116da
ruby-libs-1.8.1-7.EL4.2.i386.rpm SHA-256: 3470949e3b1f3508565ceef8dda5736c56a6216b743cf1f9e99920ee15e3fd17
ruby-libs-1.8.1-7.EL4.2.i386.rpm SHA-256: 3470949e3b1f3508565ceef8dda5736c56a6216b743cf1f9e99920ee15e3fd17
ruby-libs-1.8.1-7.EL4.2.ia64.rpm SHA-256: 1ea06b47d0a2f29fab7762efee13a057510fea1310e34e3d9d182fe1dd61d0ea
ruby-libs-1.8.1-7.EL4.2.ia64.rpm SHA-256: 1ea06b47d0a2f29fab7762efee13a057510fea1310e34e3d9d182fe1dd61d0ea
ruby-mode-1.8.1-7.EL4.2.ia64.rpm SHA-256: 41e95ef40b4d4eea84fc4b47c8ed245f5ca21509a5267f002c9a158dcf8cc6d9
ruby-mode-1.8.1-7.EL4.2.ia64.rpm SHA-256: 41e95ef40b4d4eea84fc4b47c8ed245f5ca21509a5267f002c9a158dcf8cc6d9
ruby-tcltk-1.8.1-7.EL4.2.ia64.rpm SHA-256: 2bbf7fa3d2616192dae28a5a2a62d9b9fbe27ec3da8cb0c32401c5a53d511dae
ruby-tcltk-1.8.1-7.EL4.2.ia64.rpm SHA-256: 2bbf7fa3d2616192dae28a5a2a62d9b9fbe27ec3da8cb0c32401c5a53d511dae
i386
irb-1.8.1-7.EL4.2.i386.rpm SHA-256: df168e161dc8c1052cf1e41f178d0b589d765b7e0ff385f2d6b130fb83a84c25
irb-1.8.1-7.EL4.2.i386.rpm SHA-256: df168e161dc8c1052cf1e41f178d0b589d765b7e0ff385f2d6b130fb83a84c25
ruby-1.8.1-7.EL4.2.i386.rpm SHA-256: 602a084897730f50652c0be2716394aabd851261dccfa229b5ff62d61955b7be
ruby-1.8.1-7.EL4.2.i386.rpm SHA-256: 602a084897730f50652c0be2716394aabd851261dccfa229b5ff62d61955b7be
ruby-devel-1.8.1-7.EL4.2.i386.rpm SHA-256: dcd7f0933b1307b5beeeab6a10028565539758d799ea5e222b36b8e4c53e2cc7
ruby-devel-1.8.1-7.EL4.2.i386.rpm SHA-256: dcd7f0933b1307b5beeeab6a10028565539758d799ea5e222b36b8e4c53e2cc7
ruby-docs-1.8.1-7.EL4.2.i386.rpm SHA-256: a956deb8566921781402c0ede66730ffb9f81dd63b8ce5ba52d25fb30b2e53df
ruby-docs-1.8.1-7.EL4.2.i386.rpm SHA-256: a956deb8566921781402c0ede66730ffb9f81dd63b8ce5ba52d25fb30b2e53df
ruby-libs-1.8.1-7.EL4.2.i386.rpm SHA-256: 3470949e3b1f3508565ceef8dda5736c56a6216b743cf1f9e99920ee15e3fd17
ruby-libs-1.8.1-7.EL4.2.i386.rpm SHA-256: 3470949e3b1f3508565ceef8dda5736c56a6216b743cf1f9e99920ee15e3fd17
ruby-mode-1.8.1-7.EL4.2.i386.rpm SHA-256: 160a6f9dc92a88eefdb0fc401c50e61d51a73a8d67d346bc6ca94541f4b07504
ruby-mode-1.8.1-7.EL4.2.i386.rpm SHA-256: 160a6f9dc92a88eefdb0fc401c50e61d51a73a8d67d346bc6ca94541f4b07504
ruby-tcltk-1.8.1-7.EL4.2.i386.rpm SHA-256: e392784f39014f75a4c6601b417d5c19ed06660f09de70d6cab25506bb2f1b0b
ruby-tcltk-1.8.1-7.EL4.2.i386.rpm SHA-256: e392784f39014f75a4c6601b417d5c19ed06660f09de70d6cab25506bb2f1b0b

Red Hat Enterprise Linux Server 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Server 2

SRPM
i386

Red Hat Enterprise Linux Workstation 4

SRPM
x86_64
irb-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 8350c1bc9fefbfc5527d24ce7b269047651447a887fb95cdbe037b0abc28c2a1
ruby-1.8.1-7.EL4.2.x86_64.rpm SHA-256: dd2e4beee93024f71a802aab4c990f01ede78c4f7ec57e2d593a7fca9a99762e
ruby-devel-1.8.1-7.EL4.2.x86_64.rpm SHA-256: c4b3aad16d380da3b087374fd6e0fab5eb1be69bfff7d1692be2342fe725fb73
ruby-docs-1.8.1-7.EL4.2.x86_64.rpm SHA-256: f83ae2d3292daa5d0ad134daecbb30408e93cd8e9635210731c28fe03c4a9596
ruby-libs-1.8.1-7.EL4.2.i386.rpm SHA-256: 3470949e3b1f3508565ceef8dda5736c56a6216b743cf1f9e99920ee15e3fd17
ruby-libs-1.8.1-7.EL4.2.x86_64.rpm SHA-256: e3d4faeb73462c90bb5a5f5234dfcb1a612ffb3b63e7a12ee17682f81724b6af
ruby-mode-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 41617cdf15e653951c470fabcf1d405bf6a48b5b2b07171db3b439628d363d52
ruby-tcltk-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 4adfa00c9d18719c5b2bf6313fe12687f3935606c334834c6384923acd189688
ia64
irb-1.8.1-7.EL4.2.ia64.rpm SHA-256: ebf632c4511e708c9478e933ec86fa62221025dfc74b755a1584081720dc0366
ruby-1.8.1-7.EL4.2.ia64.rpm SHA-256: fb0992a67567cacd635da0e915dc1145b521b9fa158872368867bf252883635a
ruby-devel-1.8.1-7.EL4.2.ia64.rpm SHA-256: e81a263766c4eb94815a6855a2fc7edca5162da01eb6456fdcc7a13aae7b61d6
ruby-docs-1.8.1-7.EL4.2.ia64.rpm SHA-256: 1008bd0e242c9e2cdbf3f98790859d4652f4f97a5f4577a0e7bdf7a72f0116da
ruby-libs-1.8.1-7.EL4.2.i386.rpm SHA-256: 3470949e3b1f3508565ceef8dda5736c56a6216b743cf1f9e99920ee15e3fd17
ruby-libs-1.8.1-7.EL4.2.ia64.rpm SHA-256: 1ea06b47d0a2f29fab7762efee13a057510fea1310e34e3d9d182fe1dd61d0ea
ruby-mode-1.8.1-7.EL4.2.ia64.rpm SHA-256: 41e95ef40b4d4eea84fc4b47c8ed245f5ca21509a5267f002c9a158dcf8cc6d9
ruby-tcltk-1.8.1-7.EL4.2.ia64.rpm SHA-256: 2bbf7fa3d2616192dae28a5a2a62d9b9fbe27ec3da8cb0c32401c5a53d511dae
i386
irb-1.8.1-7.EL4.2.i386.rpm SHA-256: df168e161dc8c1052cf1e41f178d0b589d765b7e0ff385f2d6b130fb83a84c25
ruby-1.8.1-7.EL4.2.i386.rpm SHA-256: 602a084897730f50652c0be2716394aabd851261dccfa229b5ff62d61955b7be
ruby-devel-1.8.1-7.EL4.2.i386.rpm SHA-256: dcd7f0933b1307b5beeeab6a10028565539758d799ea5e222b36b8e4c53e2cc7
ruby-docs-1.8.1-7.EL4.2.i386.rpm SHA-256: a956deb8566921781402c0ede66730ffb9f81dd63b8ce5ba52d25fb30b2e53df
ruby-libs-1.8.1-7.EL4.2.i386.rpm SHA-256: 3470949e3b1f3508565ceef8dda5736c56a6216b743cf1f9e99920ee15e3fd17
ruby-mode-1.8.1-7.EL4.2.i386.rpm SHA-256: 160a6f9dc92a88eefdb0fc401c50e61d51a73a8d67d346bc6ca94541f4b07504
ruby-tcltk-1.8.1-7.EL4.2.i386.rpm SHA-256: e392784f39014f75a4c6601b417d5c19ed06660f09de70d6cab25506bb2f1b0b

Red Hat Enterprise Linux Workstation 3

SRPM
x86_64
ia64
i386

Red Hat Enterprise Linux Workstation 2

SRPM
i386

Red Hat Enterprise Linux Desktop 4

SRPM
x86_64
irb-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 8350c1bc9fefbfc5527d24ce7b269047651447a887fb95cdbe037b0abc28c2a1
ruby-1.8.1-7.EL4.2.x86_64.rpm SHA-256: dd2e4beee93024f71a802aab4c990f01ede78c4f7ec57e2d593a7fca9a99762e
ruby-devel-1.8.1-7.EL4.2.x86_64.rpm SHA-256: c4b3aad16d380da3b087374fd6e0fab5eb1be69bfff7d1692be2342fe725fb73
ruby-docs-1.8.1-7.EL4.2.x86_64.rpm SHA-256: f83ae2d3292daa5d0ad134daecbb30408e93cd8e9635210731c28fe03c4a9596
ruby-libs-1.8.1-7.EL4.2.i386.rpm SHA-256: 3470949e3b1f3508565ceef8dda5736c56a6216b743cf1f9e99920ee15e3fd17
ruby-libs-1.8.1-7.EL4.2.x86_64.rpm SHA-256: e3d4faeb73462c90bb5a5f5234dfcb1a612ffb3b63e7a12ee17682f81724b6af
ruby-mode-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 41617cdf15e653951c470fabcf1d405bf6a48b5b2b07171db3b439628d363d52
ruby-tcltk-1.8.1-7.EL4.2.x86_64.rpm SHA-256: 4adfa00c9d18719c5b2bf6313fe12687f3935606c334834c6384923acd189688
i386
irb-1.8.1-7.EL4.2.i386.rpm SHA-256: df168e161dc8c1052cf1e41f178d0b589d765b7e0ff385f2d6b130fb83a84c25
ruby-1.8.1-7.EL4.2.i386.rpm SHA-256: 602a084897730f50652c0be2716394aabd851261dccfa229b5ff62d61955b7be
ruby-devel-1.8.1-7.EL4.2.i386.rpm SHA-256: dcd7f0933b1307b5beeeab6a10028565539758d799ea5e222b36b8e4c53e2cc7
ruby-docs-1.8.1-7.EL4.2.i386.rpm SHA-256: a956deb8566921781402c0ede66730ffb9f81dd63b8ce5ba52d25fb30b2e53df
ruby-libs-1.8.1-7.EL4.2.i386.rpm SHA-256: 3470949e3b1f3508565ceef8dda5736c56a6216b743cf1f9e99920ee15e3fd17
ruby-mode-1.8.1-7.EL4.2.i386.rpm SHA-256: 160a6f9dc92a88eefdb0fc401c50e61d51a73a8d67d346bc6ca94541f4b07504
ruby-tcltk-1.8.1-7.EL4.2.i386.rpm SHA-256: e392784f39014f75a4c6601b417d5c19ed06660f09de70d6cab25506bb2f1b0b

Red Hat Enterprise Linux Desktop 3

SRPM
x86_64
i386

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
irb-1.8.1-7.EL4.2.s390x.rpm SHA-256: 2ead7839457e940f62a0873f5b965e6d9f2e49bf468cddcaf08066daa6d0001e
ruby-1.8.1-7.EL4.2.s390x.rpm SHA-256: 0459525e226e9f51866873fe28aab366176156436a780ce5dee5be439adb599d
ruby-devel-1.8.1-7.EL4.2.s390x.rpm SHA-256: 376746c8136ca12a1942e3b4a0a88d9f98d344f7047a97a308f355ce02162a97
ruby-docs-1.8.1-7.EL4.2.s390x.rpm SHA-256: 3e84ab2e60919f439a315633a679640476a04637c6c5d18ef02c39a5b2fe6954
ruby-libs-1.8.1-7.EL4.2.s390.rpm SHA-256: 6df6592aeb03e3c20466ba1b497d6d03f4d467db9e8984a2110fca2137cc81ff
ruby-libs-1.8.1-7.EL4.2.s390x.rpm SHA-256: 060f04b570852d4b5638237d26529e8ca4370615a31d05c73c0488e6a8a3bca7
ruby-mode-1.8.1-7.EL4.2.s390x.rpm SHA-256: 025ede3f8f9b7ba5262944b76f6a1f7a957b5deedd332e96430cd2f078db9f9f
ruby-tcltk-1.8.1-7.EL4.2.s390x.rpm SHA-256: 6df2ff3df3a4a0f346b1650804961abf72e0bbf20bd380b6e8af2141f29e6bde
s390
irb-1.8.1-7.EL4.2.s390.rpm SHA-256: a94e80fbfa1a0460367c4272b8439725bc279df41de0fc691e073647de392d65
ruby-1.8.1-7.EL4.2.s390.rpm SHA-256: 49aa813251f77e810568d2e3bdf3cbd77b879cf683a85f3b5aa299930c3dafa8
ruby-devel-1.8.1-7.EL4.2.s390.rpm SHA-256: 9eb9577d84427399866752ee21c5a3d0e58d77c18aa975506c5226c4d2d3a331
ruby-docs-1.8.1-7.EL4.2.s390.rpm SHA-256: 01acd997e488d73f7c35bbfd0a8ea66dcd71bdf38d8e8e6d048d515275c32007
ruby-libs-1.8.1-7.EL4.2.s390.rpm SHA-256: 6df6592aeb03e3c20466ba1b497d6d03f4d467db9e8984a2110fca2137cc81ff
ruby-mode-1.8.1-7.EL4.2.s390.rpm SHA-256: dc1cc50ad8fb90bb4fee289221278a99978080fd8305882ee4384421b83cf916
ruby-tcltk-1.8.1-7.EL4.2.s390.rpm SHA-256: 19037e4a25bf414ab7b890f4fc676eb85fdf6153136836b687cfdbf98fbab492

Red Hat Enterprise Linux for IBM z Systems 3

SRPM
s390x
s390

Red Hat Enterprise Linux for Power, big endian 4

SRPM
ppc
irb-1.8.1-7.EL4.2.ppc.rpm SHA-256: af21987ed66c75a6ac0b4afe7174a9b743e77643c7807876aba451cd00211a70
ruby-1.8.1-7.EL4.2.ppc.rpm SHA-256: 92cce600148e448520560f7a9c0d4f1c75cd2440ecfe6cdb647854b22ee557b4
ruby-devel-1.8.1-7.EL4.2.ppc.rpm SHA-256: c7fe92038989d40fcc2c5c3e8a0bfee962692875c5e926ccf834d04ca748b627
ruby-docs-1.8.1-7.EL4.2.ppc.rpm SHA-256: 04fb228e2ff1a879bd576b78c897ae28de23d7b4a842eb05c05901d01dabc60e
ruby-libs-1.8.1-7.EL4.2.ppc.rpm SHA-256: f8bd8a5aa40d956306ddb2875ce426eeb1acfab2c6ed6a1d726948c2cafbef3b
ruby-libs-1.8.1-7.EL4.2.ppc64.rpm SHA-256: 582a2adfc9bb2881a31be26c34d2ff331d301c8ce05abd05603781484e4b258b
ruby-mode-1.8.1-7.EL4.2.ppc.rpm SHA-256: ddf606bde2b294bf5a17c4b7c57b2cb8f3488d2b4f7147365b9603e0cf7416d2
ruby-tcltk-1.8.1-7.EL4.2.ppc.rpm SHA-256: 77cece60f1b01d6754b60de0292320577a1ad853afacbd57bbb4b76045a872e1

Red Hat Enterprise Linux for Power, big endian 3

SRPM
ppc

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.