概要

Moderate: ruby security update

タイプ/重大度

Security Advisory: Moderate

トピック

Updated ruby packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

説明

Ruby is an extensible, interpreted, object-oriented, scripting language. It
has features to process text files and to do system management tasks.

A flaw was found in the way the Ruby POP module processed certain APOP
authentication requests. By sending certain responses when the Ruby APOP
module attempted to authenticate using APOP against a POP server, a remote
attacker could, potentially, acquire certain portions of a user's
authentication credentials. (CVE-2007-1558)

It was discovered that Ruby did not properly check the return value when
verifying X.509 certificates. This could, potentially, allow a remote
attacker to present an invalid X.509 certificate, and have Ruby treat it as
valid. (CVE-2009-0642)

A flaw was found in the way Ruby converted BigDecimal objects to Float
numbers. If an attacker were able to provide certain input for the
BigDecimal object converter, they could crash an application using this
class. (CVE-2009-1904)

All Ruby users should upgrade to these updated packages, which contain
backported patches to resolve these issues.

解決法

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

影響を受ける製品

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.3 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Server - AUS 5.3 x86_64
• Red Hat Enterprise Linux Server - AUS 5.3 ia64
• Red Hat Enterprise Linux Server - AUS 5.3 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.3 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.3 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

修正

• BZ - 241191 - CVE-2007-1558 fetchmail/mutt/evolution/...: APOP password disclosure vulnerability
• BZ - 486183 - CVE-2009-0642 ruby: Incorrect checks for validity of X.509 certificates
• BZ - 504958 - CVE-2009-1904 ruby: DoS vulnerability in BigDecimal

CVE

• CVE-2007-1558
• CVE-2009-0642
• CVE-2009-1904

参考資料

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 5

SRPM
x86_64
ruby-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 2a5bda85d63b18669cde37400f67ee39f1b265a0d62327fbd5bdde11354a173e
ruby-devel-1.8.5-5.el5_3.7.i386.rpm	SHA-256: a2b7be14da13c7d99118a617d9841fd857466cf9a34d620c772665be80d01911
ruby-devel-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: a237ce90b3e8f2be1b6437c88b80d43094e8f4aa9bb733bec8cc6624ccfcd7f2
ruby-docs-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 3b9bbee52ee7b0bfb783cfacba05fd5e25e3a3879276fec02f244fc971f272eb
ruby-irb-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: a902a5e2b99a359dbce451b49b7db891553851646c3e4de3a8ae1fa7d0beb871
ruby-libs-1.8.5-5.el5_3.7.i386.rpm	SHA-256: de3d213f45bc1ac3dbf98632d87d9632625b53b228d519515289729c79b157ed
ruby-libs-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: ea74a6250ca5d3f33f7d53740a15171ccb8955ab654e99899d5b69edd72f3a1a
ruby-mode-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: ae0ccdb891dc275dab992f28b78666835e9b61888453ea458c1442b8e250b4e7
ruby-rdoc-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 693c3cd8718fa115e32bd06e451f4385df3a18f5ac1f53beb0a4bab1ca1dcf9d
ruby-ri-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: e8889db05eed760063417671b0490caacb9cb3164e4c04dc1b0ae10b98e217d9
ruby-tcltk-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 70b6e5634653687c10742ac3060e56d5d82cbeebdd86da5382b0924ab300671b
i386
ruby-devel-1.8.5-5.el5_3.7.i386.rpm	SHA-256: a2b7be14da13c7d99118a617d9841fd857466cf9a34d620c772665be80d01911
ruby-libs-1.8.5-5.el5_3.7.i386.rpm	SHA-256: de3d213f45bc1ac3dbf98632d87d9632625b53b228d519515289729c79b157ed

Red Hat Enterprise Linux Workstation 5

SRPM
x86_64
ruby-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 2a5bda85d63b18669cde37400f67ee39f1b265a0d62327fbd5bdde11354a173e
ruby-devel-1.8.5-5.el5_3.7.i386.rpm	SHA-256: a2b7be14da13c7d99118a617d9841fd857466cf9a34d620c772665be80d01911
ruby-devel-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: a237ce90b3e8f2be1b6437c88b80d43094e8f4aa9bb733bec8cc6624ccfcd7f2
ruby-docs-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 3b9bbee52ee7b0bfb783cfacba05fd5e25e3a3879276fec02f244fc971f272eb
ruby-irb-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: a902a5e2b99a359dbce451b49b7db891553851646c3e4de3a8ae1fa7d0beb871
ruby-libs-1.8.5-5.el5_3.7.i386.rpm	SHA-256: de3d213f45bc1ac3dbf98632d87d9632625b53b228d519515289729c79b157ed
ruby-libs-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: ea74a6250ca5d3f33f7d53740a15171ccb8955ab654e99899d5b69edd72f3a1a
ruby-mode-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: ae0ccdb891dc275dab992f28b78666835e9b61888453ea458c1442b8e250b4e7
ruby-rdoc-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 693c3cd8718fa115e32bd06e451f4385df3a18f5ac1f53beb0a4bab1ca1dcf9d
ruby-ri-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: e8889db05eed760063417671b0490caacb9cb3164e4c04dc1b0ae10b98e217d9
ruby-tcltk-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 70b6e5634653687c10742ac3060e56d5d82cbeebdd86da5382b0924ab300671b
i386
ruby-devel-1.8.5-5.el5_3.7.i386.rpm	SHA-256: a2b7be14da13c7d99118a617d9841fd857466cf9a34d620c772665be80d01911
ruby-libs-1.8.5-5.el5_3.7.i386.rpm	SHA-256: de3d213f45bc1ac3dbf98632d87d9632625b53b228d519515289729c79b157ed

Red Hat Enterprise Linux Desktop 5

SRPM
x86_64
ruby-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 2a5bda85d63b18669cde37400f67ee39f1b265a0d62327fbd5bdde11354a173e
ruby-docs-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 3b9bbee52ee7b0bfb783cfacba05fd5e25e3a3879276fec02f244fc971f272eb
ruby-irb-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: a902a5e2b99a359dbce451b49b7db891553851646c3e4de3a8ae1fa7d0beb871
ruby-libs-1.8.5-5.el5_3.7.i386.rpm	SHA-256: de3d213f45bc1ac3dbf98632d87d9632625b53b228d519515289729c79b157ed
ruby-libs-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: ea74a6250ca5d3f33f7d53740a15171ccb8955ab654e99899d5b69edd72f3a1a
ruby-rdoc-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 693c3cd8718fa115e32bd06e451f4385df3a18f5ac1f53beb0a4bab1ca1dcf9d
ruby-ri-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: e8889db05eed760063417671b0490caacb9cb3164e4c04dc1b0ae10b98e217d9
ruby-tcltk-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 70b6e5634653687c10742ac3060e56d5d82cbeebdd86da5382b0924ab300671b
i386
ruby-libs-1.8.5-5.el5_3.7.i386.rpm	SHA-256: de3d213f45bc1ac3dbf98632d87d9632625b53b228d519515289729c79b157ed

Red Hat Enterprise Linux Server from RHUI 5

SRPM
x86_64
ruby-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 2a5bda85d63b18669cde37400f67ee39f1b265a0d62327fbd5bdde11354a173e
ruby-devel-1.8.5-5.el5_3.7.i386.rpm	SHA-256: a2b7be14da13c7d99118a617d9841fd857466cf9a34d620c772665be80d01911
ruby-devel-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: a237ce90b3e8f2be1b6437c88b80d43094e8f4aa9bb733bec8cc6624ccfcd7f2
ruby-docs-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 3b9bbee52ee7b0bfb783cfacba05fd5e25e3a3879276fec02f244fc971f272eb
ruby-irb-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: a902a5e2b99a359dbce451b49b7db891553851646c3e4de3a8ae1fa7d0beb871
ruby-libs-1.8.5-5.el5_3.7.i386.rpm	SHA-256: de3d213f45bc1ac3dbf98632d87d9632625b53b228d519515289729c79b157ed
ruby-libs-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: ea74a6250ca5d3f33f7d53740a15171ccb8955ab654e99899d5b69edd72f3a1a
ruby-mode-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: ae0ccdb891dc275dab992f28b78666835e9b61888453ea458c1442b8e250b4e7
ruby-rdoc-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 693c3cd8718fa115e32bd06e451f4385df3a18f5ac1f53beb0a4bab1ca1dcf9d
ruby-ri-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: e8889db05eed760063417671b0490caacb9cb3164e4c04dc1b0ae10b98e217d9
ruby-tcltk-1.8.5-5.el5_3.7.x86_64.rpm	SHA-256: 70b6e5634653687c10742ac3060e56d5d82cbeebdd86da5382b0924ab300671b
i386
ruby-devel-1.8.5-5.el5_3.7.i386.rpm	SHA-256: a2b7be14da13c7d99118a617d9841fd857466cf9a34d620c772665be80d01911
ruby-libs-1.8.5-5.el5_3.7.i386.rpm	SHA-256: de3d213f45bc1ac3dbf98632d87d9632625b53b228d519515289729c79b157ed