Synopsis

Moderate: ruby security update

Type/Severity

Security Advisory: Moderate

Topic

Updated ruby packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Ruby is an extensible, interpreted, object-oriented, scripting language. It
has features to process text files and to do system management tasks.

A flaw was found in the way large amounts of memory were allocated on
64-bit systems when using the BigDecimal class. A context-dependent
attacker could use this flaw to cause memory corruption, causing a Ruby
application that uses the BigDecimal class to crash or, possibly, execute
arbitrary code. This issue did not affect 32-bit systems. (CVE-2011-0188)

It was found that WEBrick (the Ruby HTTP server toolkit) did not filter
terminal escape sequences from its log files. A remote attacker could use
specially-crafted HTTP requests to inject terminal escape sequences into
the WEBrick log files. If a victim viewed the log files with a terminal
emulator, it could result in control characters being executed with the
privileges of that user. (CVE-2009-4492)

A cross-site scripting (XSS) flaw was found in the way WEBrick displayed
error pages. A remote attacker could use this flaw to perform a cross-site
scripting attack against victims by tricking them into visiting a
specially-crafted URL. (CVE-2010-0541)

A flaw was found in the method for translating an exception message into a
string in the Exception class. A remote attacker could use this flaw to
bypass safe level 4 restrictions, allowing untrusted (tainted) code to
modify arbitrary, trusted (untainted) strings, which safe level 4
restrictions would otherwise prevent. (CVE-2011-1005)

Red Hat would like to thank Drew Yao of Apple Product Security for
reporting the CVE-2011-0188 and CVE-2010-0541 issues.

All Ruby users should upgrade to these updated packages, which contain
backported patches to resolve these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 4.8 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.8 ppc

Fixes

• BZ - 554485 - CVE-2009-4492 ruby WEBrick log escape sequence
• BZ - 587731 - CVE-2010-0541 Ruby WEBrick javascript injection flaw
• BZ - 678920 - CVE-2011-1005 Ruby: Untrusted codes able to modify arbitrary strings
• BZ - 682332 - CVE-2011-0188 ruby: memory corruption in BigDecimal on 64bit platforms

CVEs

• CVE-2009-4492
• CVE-2010-0541
• CVE-2011-1005
• CVE-2011-0188

References

• https://access.redhat.com/security/updates/classification/#moderate
• http://www.ruby-lang.org/en/news/2011/02/18/exception-methods-can-bypass-safe/
• http://www.ruby-lang.org/en/news/2010/01/10/webrick-escape-sequence-injection/
• http://www.ruby-lang.org/en/news/2010/08/16/xss-in-webrick-cve-2010-0541/

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
s390x
ruby-libs-1.8.1-16.el4.s390.rpm	SHA-256: b4a4774db6583427a526eb9230a4ae5377828543341da2be88b2bb48bad84191
s390
irb-1.8.1-16.el4.s390.rpm	SHA-256: 7fd960e6e8587683f800afea849e7deb53de6e1ed7b7f7ac4eab1be695757c8f
ruby-1.8.1-16.el4.s390.rpm	SHA-256: 947e49cbfef5aacc1dcb9d9d3994a9caf544ed13bb329f55b2dec379d6a81ee4
ruby-devel-1.8.1-16.el4.s390.rpm	SHA-256: b91b0c1f74b02f63d8c68c0b58235bef2c82afecf318f4e99d54d2dde891de4f
ruby-docs-1.8.1-16.el4.s390.rpm	SHA-256: d61d97a2fe0cfe7bf3a762dd51515b0981f0229df47fcad7199cb5d68fab8820
ruby-libs-1.8.1-16.el4.s390.rpm	SHA-256: b4a4774db6583427a526eb9230a4ae5377828543341da2be88b2bb48bad84191
ruby-mode-1.8.1-16.el4.s390.rpm	SHA-256: 9422ad6925324f1f1ed2aa86f34cb2e0848ae18c0fdb990da4add02368fc751e
ruby-tcltk-1.8.1-16.el4.s390.rpm	SHA-256: f4ee1a88a4def10410d90b2ce2fdbe502e868782a8985c9b2b1517582cab2e9e

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.8

SRPM
s390x
ruby-libs-1.8.1-16.el4.s390.rpm	SHA-256: b4a4774db6583427a526eb9230a4ae5377828543341da2be88b2bb48bad84191
s390
irb-1.8.1-16.el4.s390.rpm	SHA-256: 7fd960e6e8587683f800afea849e7deb53de6e1ed7b7f7ac4eab1be695757c8f
ruby-1.8.1-16.el4.s390.rpm	SHA-256: 947e49cbfef5aacc1dcb9d9d3994a9caf544ed13bb329f55b2dec379d6a81ee4
ruby-devel-1.8.1-16.el4.s390.rpm	SHA-256: b91b0c1f74b02f63d8c68c0b58235bef2c82afecf318f4e99d54d2dde891de4f
ruby-docs-1.8.1-16.el4.s390.rpm	SHA-256: d61d97a2fe0cfe7bf3a762dd51515b0981f0229df47fcad7199cb5d68fab8820
ruby-libs-1.8.1-16.el4.s390.rpm	SHA-256: b4a4774db6583427a526eb9230a4ae5377828543341da2be88b2bb48bad84191
ruby-mode-1.8.1-16.el4.s390.rpm	SHA-256: 9422ad6925324f1f1ed2aa86f34cb2e0848ae18c0fdb990da4add02368fc751e
ruby-tcltk-1.8.1-16.el4.s390.rpm	SHA-256: f4ee1a88a4def10410d90b2ce2fdbe502e868782a8985c9b2b1517582cab2e9e