Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 465
Alerts This Week
Warning Icon 1 465

Ubuntu 12.10 & 12.04 LTS USN-1733-1: Ruby Security Fixes (DoS, XSS)

ubuntu
Calendar Grey February 21, 2013
Scroller Ubuntu
To secure Ruby 1.9.1 on Ubuntu, manage hash values against collisions, consider upgrading Ruby, and validate inputs thoroughly for safety.
Several security issues were fixed in Ruby.

Summary

Several security issues were fixed in Ruby.

Software Description:

- ruby1.9.1: Interpreter of object-oriented scripting language Ruby

Details:

Jean-Philippe Aumasson discovered that Ruby incorrectly generated

predictable hash values. An attacker could use this issue to generate hash

collisions and cause a denial of service. (CVE-2012-5371)

Evgeny Ermakov discovered that documentation generated by rdoc is

vulnerable to a cross-site scripting issue. With cross-site scripting

vulnerabilities, if a user were tricked into viewing a specially crafted

page, a remote attacker could exploit this to modify the contents, or steal

confidential data, within the same domain. (CVE-2013-0256)

Thomas Hollstegge and Ben Murphy discovered that the JSON implementation

in Ruby incorrectly handled certain crafted documents. An attacker could

use this issue to cause a denial of service or bypass certain protection

mechanisms. (CVE-2013-0269)

Topics%20covered

Topics Covered

security advisory denial of service cross-site scripting ubuntu ruby

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  libruby1.9.1                    1.9.3.194-1ubuntu1.3
  ruby1.9.1                       1.9.3.194-1ubuntu1.3

Ubuntu 12.04 LTS:
  libruby1.9.1                    1.9.3.0-1ubuntu2.5
  ruby1.9.1                       1.9.3.0-1ubuntu2.5

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-1733-1

CVE-2012-5371, CVE-2013-0256, CVE-2013-0269

Severity
important
Lowest
Low
Medium
High
Critical

February 21, 2013

Topics%20covered

Topics Covered

security advisory denial of service cross-site scripting ubuntu ruby

Package Information

https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.194-1ubuntu1.3
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.0-1ubuntu2.5

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.