Advisories
Vulnerability Database
PoC
Viruses
Research Lab
Mandriva

[ MDKSA-2006:192 ] - Updated ruby packages fix DoS vulnerability

03 november, 2006

----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2006:192
http://www.mandriva.com/security/
_______________________________________________________________________

Package : ruby
Date : October 27, 2006
Affected: 2006.0, 2007.0, Corporate 3.0, Corporate 4.0
_______________________________________________________________________

Problem Description:

The CGI library in Ruby 1.8 allowed a remote attacker to cause a Denial
of Service via an HTTP request with a multipart MIME body that
contained an invalid boundary specifier, which would result in an
infinite loop and CPU consumption.

Updated packages have been patched to correct this issue.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5467
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2006.0:
f0272f52ef6c1997871a8e6ec02e1bd7 2006.0/i586/ruby-1.8.2-7.4.20060mdk.i586.rpm
b7726c3839fdd0acc10108de90d188c3 2006.0/i586/ruby-devel-1.8.2-7.4.20060mdk.i586.rpm
d6eef115bcdc8eb7c35df35e7fc1ca66 2006.0/i586/ruby-doc-1.8.2-7.4.20060mdk.i586.rpm
8fc499b4fea37a0c3ff31bb2047d639b 2006.0/i586/ruby-tk-1.8.2-7.4.20060mdk.i586.rpm
3a57108ef04cb1efab8640dcb0029fb1 2006.0/SRPMS/ruby-1.8.2-7.4.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
cf8394aec203b6cb6bf0de061644887f 2006.0/x86_64/ruby-1.8.2-7.4.20060mdk.x86_64.rpm
285d54c1972ecd72f79a14608f3fa455 2006.0/x86_64/ruby-devel-1.8.2-7.4.20060mdk.x86_64.rpm
45f0e3385960d938e9cb13dd0752963e 2006.0/x86_64/ruby-doc-1.8.2-7.4.20060mdk.x86_64.rpm
685b25cd67aa74286cc96bb69eedae33 2006.0/x86_64/ruby-tk-1.8.2-7.4.20060mdk.x86_64.rpm
3a57108ef04cb1efab8640dcb0029fb1 2006.0/SRPMS/ruby-1.8.2-7.4.20060mdk.src.rpm

Mandriva Linux 2007.0:
f4c71e44767723c560f68611fd5ed40f 2007.0/i586/ruby-1.8.5-2.1mdv2007.0.i586.rpm
9774e776877853e9d8dac21a31ab916c 2007.0/i586/ruby-devel-1.8.5-2.1mdv2007.0.i586.rpm
445edc4e125317acbe21042ba4d81d65 2007.0/i586/ruby-doc-1.8.5-2.1mdv2007.0.i586.rpm
538123be42ba8395c10fbd3252605e50 2007.0/i586/ruby-tk-1.8.5-2.1mdv2007.0.i586.rpm
31e25bf195003a42cd27ff380c350be9 2007.0/SRPMS/ruby-1.8.5-2.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
b1377e678c818d27fa4f9894da35adb2 2007.0/x86_64/ruby-1.8.5-2.1mdv2007.0.x86_64.rpm
ef84cbd877282a57b86108acf87e1859 2007.0/x86_64/ruby-devel-1.8.5-2.1mdv2007.0.x86_64.rpm
828ade30bc1505a455f291efc110078c 2007.0/x86_64/ruby-doc-1.8.5-2.1mdv2007.0.x86_64.rpm
e5ac4f7397157fc126ae76af869b35e4 2007.0/x86_64/ruby-tk-1.8.5-2.1mdv2007.0.x86_64.rpm
31e25bf195003a42cd27ff380c350be9 2007.0/SRPMS/ruby-1.8.5-2.1mdv2007.0.src.rpm

Corporate 3.0:
062a53f26ee73b0e570dec87401bd37e corporate/3.0/i586/ruby-1.8.1-1.7.C30mdk.i586.rpm
abb7bbb216dd65e14756c3549053b404 corporate/3.0/i586/ruby-devel-1.8.1-1.7.C30mdk.i586.rpm
87ece8cd4f0ef4309fe8cca98423467a corporate/3.0/i586/ruby-doc-1.8.1-1.7.C30mdk.i586.rpm
cfca4b4b06d907d0fae324194a944add corporate/3.0/i586/ruby-tk-1.8.1-1.7.C30mdk.i586.rpm
75afbf41268564d47f5fc9df31f95ab6 corporate/3.0/SRPMS/ruby-1.8.1-1.7.C30mdk.src.rpm

Corporate 3.0/X86_64:
5e80b3f821ccbbceaf650469c3a28c2c corporate/3.0/x86_64/ruby-1.8.1-1.7.C30mdk.x86_64.rpm
25b68104a5074ae948125ad78dbaaf1a corporate/3.0/x86_64/ruby-devel-1.8.1-1.7.C30mdk.x86_64.rpm
9e4938f74c6ea5a7198c281dbbecdf0a corporate/3.0/x86_64/ruby-doc-1.8.1-1.7.C30mdk.x86_64.rpm
4f1315fd9c95e5241e3978890a730bbe corporate/3.0/x86_64/ruby-tk-1.8.1-1.7.C30mdk.x86_64.rpm
75afbf41268564d47f5fc9df31f95ab6 corporate/3.0/SRPMS/ruby-1.8.1-1.7.C30mdk.src.rpm

Corporate 4.0:
ba740fba1e7362102a1ce5e19392bbca corporate/4.0/i586/ruby-1.8.2-7.4.20060mlcs4.i586.rpm
5e73abcddf887587d1e845be09f95c3e corporate/4.0/i586/ruby-devel-1.8.2-7.4.20060mlcs4.i586.rpm
f08a296b52bc64dfe626ca88718c0a8e corporate/4.0/i586/ruby-doc-1.8.2-7.4.20060mlcs4.i586.rpm
7faf87d0e62775fe46a3b9f05f677fb4 corporate/4.0/i586/ruby-tk-1.8.2-7.4.20060mlcs4.i586.rpm
2a7981a830a7a9384b5ed2a3272d9aaa corporate/4.0/SRPMS/ruby-1.8.2-7.4.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
05ecad036963dc16c0e5cd0bfb04efed corporate/4.0/x86_64/ruby-1.8.2-7.4.20060mlcs4.x86_64.rpm
71dd68f19989395dab35168a1338f25b corporate/4.0/x86_64/ruby-devel-1.8.2-7.4.20060mlcs4.x86_64.rpm
7199919374de62c24cb15cf879a88dbe corporate/4.0/x86_64/ruby-doc-1.8.2-7.4.20060mlcs4.x86_64.rpm
35f6c32ce1c9d93f36f60dae3a1f41d5 corporate/4.0/x86_64/ruby-tk-1.8.2-7.4.20060mlcs4.x86_64.rpm
2a7981a830a7a9384b5ed2a3272d9aaa corporate/4.0/SRPMS/ruby-1.8.2-7.4.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFFQnQJmqjQ0CJFipgRAtrBAKDkVKlpHdfp/ItaZFkXb0jPbxaZ2QCgpxlj
A0fzM1TtV4Xy/Cla5dWAkCU=
=9IHn
-----END PGP SIGNATURE---
Search
National Vulnerability Database

CVE-2010-3197

IBM DB2 9.7 before FP2 does not perform the expected access control on the monitor administrative views in the SYSIBMADM schema, which allows remote attackers to obtain sensitive information via unspecified vectors.

31 august, 2010

CVE-2010-3196

IBM DB2 9.7 before FP2, when AUTO_REVAL is IMMEDIATE, allows remote authenticated users to cause a denial of service (loss of privileges) to a view owner by defining a dependent view.

31 august, 2010

CVE-2010-3195

Unspecified vulnerability in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 on Windows Server 2008 allows attackers to cause a denial of service (trap) via vectors involving "special group and user enumeration."

31 august, 2010

CVE-2010-3194

The DB2DART program in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 allows attackers to bypass intended file access restrictions via unspecified vectors related to overwriting files owned by an instance owner.

31 august, 2010

CVE-2010-3193

Unspecified vulnerability in the DB2STST program in IBM DB2 9.1 before FP9, 9.5 before FP6, and 9.7 before FP2 has unknown impact and attack vectors.

31 august, 2010

CVE-2010-2365

Cross-site scripting (XSS) vulnerability in Free CGI Moo moobbs2 before 1.03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

31 august, 2010

CVE-2010-2364

Cross-site scripting (XSS) vulnerability in Free CGI Moo moobbs before 1.03 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

31 august, 2010

CVE-2010-3191

Untrusted search path vulnerability in Adobe Captivate 5.0.0.596, and possibly other versions, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in ...

31 august, 2010

CVE-2010-3190

Untrusted search path vulnerability in ATL MFC Trace Tool (AtlTraceT ool8.exe), as used in Microsoft Visual Studio, allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse ...

31 august, 2010

CVE-2010-3189

The extSetOwner function in the UfProxyBrowserCtrl ActiveX control (UfPBCt rl.dll) in Trend Micro Internet Security Pro 2010 allows remote attackers to execute arbitrary code via an invalid address that is dereferenced as a pointer.

31 august, 2010

ÐîÑ

Microsoft Windows XP Indeo Filter DLL Hijacking PoC

Target: Microsoft Windows XP
Impact: Code execution

avast! <= 5.0.594 license files DLL Hijacking Exploit (mfc90loc.dll)

Target: avast! 5.0.594 and previous versions
Impact: Code execution

Windows Live Mail DLL Hijacking Exploit (dwmapi.dll)

Target: Windows Live Mail
Impact: Code execution

AdvertismentAbout ProjectContact UsCopyrightExportRSSMy SettingsMap