-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2009.0101                  AUSCERT Advisory

                             [Win][UNIX/Linux]
                       Ruby: Access Privileged Data
                               24 April 2009
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              Ruby
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact:               Access Privileged Data
                      Provide Misleading Information
                      Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2008-1447 CVE-2007-1558
Member content until: Friday, May 22 2009

Ref:                  AL-2008.0080
                      AL-2007.0070

OVERVIEW:

      Updates have been released for Ruby 1.8.7 and 1.8.6, addressing
      multiple vulnerabilities.


IMPACT:

      The vendor reports the following:

      "Updates to already-released Ruby 1.8.7 and 1.8.6 have been released.
      This time we have fixed dozens of bugs, including workarounds for 
      CVE-2007-1558 and CVE-2008-1447. Many segfaults are also fixed." [1]

      The National Vulnerability Database describes the CVEs as:

      (CVE-2007-1558)
      "The APOP protocol allows remote attackers to guess the first 3 
      characters of a password via man-in-the-middle (MITM) attacks that use 
      crafted message IDs and MD5 collisions." [2]

      (CVE-2008-1447)
      "The DNS protocol, as implemented in (1) BIND 8 and 9 before 9.5.0-P1, 
      9.4.2-P1, and 9.3.5-P1; (2) Microsoft DNS in Windows 2000 SP4, XP SP2 
      and SP3, and Server 2003 SP1 and SP2; and other implementations allow 
      remote attackers to spoof DNS traffic via a birthday attack that uses 
      in-bailiwick referrals to conduct cache poisoning against recursive 
      resolvers, related to insufficient randomness of DNS transaction IDs 
      and source ports, aka 'DNS Insufficient Socket Entropy Vulnerability' 
      or 'the Kaminsky bug'." [3]


MITIGATION:

      The updated versions are available from the vendor's website. [1]


REFERENCES:

      [1] Ruby 1.8.7-p160 and 1.8.6-p368 released
          http://www.ruby-lang.org/en/news/2009/04/18/ruby-1-8-7-p160-and-1-8-6-p368-released/

      [2] Vulnerability Summary for CVE-2007-1558
          http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-1558

      [3] Vulnerability Summary for CVE-2008-1447 
          http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-1447

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFJ8TQRNVH5XJJInbgRAklqAKCJ6VkhGTGJdNtSsrS7mNK80lI7owCeN8xU
f4ZHxPpKxoUP/EFvLIXRLR4=
=p9wa
-----END PGP SIGNATURE-----