-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Updated ruby package fixes denial of service issue
Advisory ID:       RHSA-2004:635-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2004-635.html
Issue date:        2004-12-13
Updated on:        2004-12-13
Product:           Red Hat Enterprise Linux
CVE Names:         CAN-2004-0983
---------------------------------------------------------------------

1. Summary:

An updated ruby package that fixes a denial of service issue for the CGI
instance is now available.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64

3. Problem description:

Ruby is an interpreted scripting language for object-oriented programming.

A flaw was dicovered in the CGI module of Ruby.  If empty data is sent by
the POST method to the CGI script which requires MIME type
multipart/form-data, it can get stuck in a loop.  A remote attacker could
trigger this flaw and cause a denial of service.  The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
CAN-2004-0983 to this issue.

Users are advised to upgrade to this erratum package, which contains a
backported patch to cgi.rb.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  Use Red Hat
Network to download and update your packages.  To launch the Red Hat
Update Agent, use the following command:

    up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

    http://www.redhat.com/docs/manuals/enterprise/

5. Bug IDs fixed (http://bugzilla.redhat.com/ for more info):

138362 - CAN-2004-0983 Denial of Service in Ruby

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:
ruby-1.6.4-2.AS21.1.src.rpm
1c9c90f0ab2a2d99aacb3ca4b14868c2  ruby-1.6.4-2.AS21.1.src.rpm

i386:
984de6c8bd15661642cf96852eec8594  irb-1.6.4-2.AS21.1.i386.rpm
228efa4a0710253ed381d0cb7288654b  ruby-1.6.4-2.AS21.1.i386.rpm
d45f217ef393decea4bfc43822fad7b3  ruby-devel-1.6.4-2.AS21.1.i386.rpm
e2eb1318a5a5c800024859f2b8e0bf02  ruby-docs-1.6.4-2.AS21.1.i386.rpm
edea06b8999c1710ba66d6c580636934  ruby-libs-1.6.4-2.AS21.1.i386.rpm
83393ce9d2ffcaa9159c85fe2ea877f8  ruby-tcltk-1.6.4-2.AS21.1.i386.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS:
ruby-1.6.4-2.AS21.1.src.rpm
1c9c90f0ab2a2d99aacb3ca4b14868c2  ruby-1.6.4-2.AS21.1.src.rpm

i386:
984de6c8bd15661642cf96852eec8594  irb-1.6.4-2.AS21.1.i386.rpm
228efa4a0710253ed381d0cb7288654b  ruby-1.6.4-2.AS21.1.i386.rpm
d45f217ef393decea4bfc43822fad7b3  ruby-devel-1.6.4-2.AS21.1.i386.rpm
e2eb1318a5a5c800024859f2b8e0bf02  ruby-docs-1.6.4-2.AS21.1.i386.rpm
edea06b8999c1710ba66d6c580636934  ruby-libs-1.6.4-2.AS21.1.i386.rpm
83393ce9d2ffcaa9159c85fe2ea877f8  ruby-tcltk-1.6.4-2.AS21.1.i386.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS:
ruby-1.6.4-2.AS21.1.src.rpm
1c9c90f0ab2a2d99aacb3ca4b14868c2  ruby-1.6.4-2.AS21.1.src.rpm

i386:
984de6c8bd15661642cf96852eec8594  irb-1.6.4-2.AS21.1.i386.rpm
228efa4a0710253ed381d0cb7288654b  ruby-1.6.4-2.AS21.1.i386.rpm
d45f217ef393decea4bfc43822fad7b3  ruby-devel-1.6.4-2.AS21.1.i386.rpm
e2eb1318a5a5c800024859f2b8e0bf02  ruby-docs-1.6.4-2.AS21.1.i386.rpm
edea06b8999c1710ba66d6c580636934  ruby-libs-1.6.4-2.AS21.1.i386.rpm
83393ce9d2ffcaa9159c85fe2ea877f8  ruby-tcltk-1.6.4-2.AS21.1.i386.rpm

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/ruby-1.6.8-9.EL3.3.src.rpm
2f01d4591ff0fc041a544a7903b1808d  ruby-1.6.8-9.EL3.3.src.rpm

i386:
f408badb2510f463b5c7872e69a90efc  irb-1.6.8-9.EL3.3.i386.rpm
28689571cc04893ae54659d3bd50600f  ruby-1.6.8-9.EL3.3.i386.rpm
6f58c9789a0215e620b07761864d49e1  ruby-devel-1.6.8-9.EL3.3.i386.rpm
f2989414a97a41d85efa0386cfd6e63d  ruby-docs-1.6.8-9.EL3.3.i386.rpm
645e9618992229a97d7e1de2dbb5c691  ruby-libs-1.6.8-9.EL3.3.i386.rpm
f39588cdce470d68cf022ef3d4b7c17d  ruby-mode-1.6.8-9.EL3.3.i386.rpm
58f1aaa85a9bb7ab46a85dd339b57004  ruby-tcltk-1.6.8-9.EL3.3.i386.rpm

ia64:
c592891960b9b93d210b6a83811c847f  irb-1.6.8-9.EL3.3.ia64.rpm
7ac0fee7db9ee459261c63e93546983e  ruby-1.6.8-9.EL3.3.ia64.rpm
33cfff0cc59df6f4bb99c6f10f7cfe42  ruby-devel-1.6.8-9.EL3.3.ia64.rpm
9646d7fac418cec6cbe503f80d61c0c4  ruby-docs-1.6.8-9.EL3.3.ia64.rpm
ac7060784a405a2f2d32c400f20981a9  ruby-libs-1.6.8-9.EL3.3.ia64.rpm
76f778eddc74e655d417cae54b6911ed  ruby-mode-1.6.8-9.EL3.3.ia64.rpm
3a61c755364d2c2fc40235ca174c4109  ruby-tcltk-1.6.8-9.EL3.3.ia64.rpm

ppc:
2e78623c3afa71514c422606dcea0eb8  irb-1.6.8-9.EL3.3.ppc.rpm
1b494554641426f9cc469bdea01b3de2  ruby-1.6.8-9.EL3.3.ppc.rpm
c12cf463dda2389c1865643c04a2f200  ruby-devel-1.6.8-9.EL3.3.ppc.rpm
77ebb60cb2b619401afb643b0e417797  ruby-docs-1.6.8-9.EL3.3.ppc.rpm
b20f57bfcdff1732a82a8e3d5f939d80  ruby-libs-1.6.8-9.EL3.3.ppc.rpm
481812301c538d031458b33ac45377ba  ruby-mode-1.6.8-9.EL3.3.ppc.rpm
1e68c1c503209d0a00b1d6c49e6f1cc7  ruby-tcltk-1.6.8-9.EL3.3.ppc.rpm

s390:
417a2dae8057853d95c01752b855a85b  irb-1.6.8-9.EL3.3.s390.rpm
fdcecea5dc82c81fa2def2dd6882be61  ruby-1.6.8-9.EL3.3.s390.rpm
101677cc586a6e0ffa2243f4d44e1690  ruby-devel-1.6.8-9.EL3.3.s390.rpm
b9c6e991d23c84cf983c0dda0218b056  ruby-docs-1.6.8-9.EL3.3.s390.rpm
551748a998a181b7aa87d64d97e959b2  ruby-libs-1.6.8-9.EL3.3.s390.rpm
331c153e38936930ee94724649129d4e  ruby-mode-1.6.8-9.EL3.3.s390.rpm
a01479d847ef53fbad6b7878ace4c326  ruby-tcltk-1.6.8-9.EL3.3.s390.rpm

s390x:
dc524b6c4b51ceb1d09fb9aa8f50bfb5  irb-1.6.8-9.EL3.3.s390x.rpm
d067c97c8f1b63216608df91b79f3346  ruby-1.6.8-9.EL3.3.s390x.rpm
ca5f632329db91a7d8b0905dfa0c4b98  ruby-devel-1.6.8-9.EL3.3.s390x.rpm
5d54cbc527a849531713ec8569b0b02a  ruby-docs-1.6.8-9.EL3.3.s390x.rpm
f184c8c8d7c83527fdc981577050416e  ruby-libs-1.6.8-9.EL3.3.s390x.rpm
77d175cda989287452933c0f419a2a1e  ruby-mode-1.6.8-9.EL3.3.s390x.rpm
69b9dd6dcea803c1e83339fa220ef441  ruby-tcltk-1.6.8-9.EL3.3.s390x.rpm

x86_64:
8ba124cf1c2c7afb3ad723a20b7d5c0d  irb-1.6.8-9.EL3.3.x86_64.rpm
08fbcb3dbbcc4f6007ff5bb553101e3a  ruby-1.6.8-9.EL3.3.x86_64.rpm
f919fb4d57ac9007db765d15169bb448  ruby-devel-1.6.8-9.EL3.3.x86_64.rpm
9c878a656d96677a21eaeffc98445862  ruby-docs-1.6.8-9.EL3.3.x86_64.rpm
f1b99550c731bb413f8f22bf2af6da95  ruby-libs-1.6.8-9.EL3.3.x86_64.rpm
4900c7792a3c986a8cfcb1ea78ce6045  ruby-mode-1.6.8-9.EL3.3.x86_64.rpm
81255d577d75df37f37461811121aa0e  ruby-tcltk-1.6.8-9.EL3.3.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:
ruby-1.6.8-9.EL3.3.src.rpm
2f01d4591ff0fc041a544a7903b1808d  ruby-1.6.8-9.EL3.3.src.rpm

i386:
f408badb2510f463b5c7872e69a90efc  irb-1.6.8-9.EL3.3.i386.rpm
28689571cc04893ae54659d3bd50600f  ruby-1.6.8-9.EL3.3.i386.rpm
6f58c9789a0215e620b07761864d49e1  ruby-devel-1.6.8-9.EL3.3.i386.rpm
f2989414a97a41d85efa0386cfd6e63d  ruby-docs-1.6.8-9.EL3.3.i386.rpm
645e9618992229a97d7e1de2dbb5c691  ruby-libs-1.6.8-9.EL3.3.i386.rpm
f39588cdce470d68cf022ef3d4b7c17d  ruby-mode-1.6.8-9.EL3.3.i386.rpm
58f1aaa85a9bb7ab46a85dd339b57004  ruby-tcltk-1.6.8-9.EL3.3.i386.rpm

x86_64:
8ba124cf1c2c7afb3ad723a20b7d5c0d  irb-1.6.8-9.EL3.3.x86_64.rpm
08fbcb3dbbcc4f6007ff5bb553101e3a  ruby-1.6.8-9.EL3.3.x86_64.rpm
f919fb4d57ac9007db765d15169bb448  ruby-devel-1.6.8-9.EL3.3.x86_64.rpm
9c878a656d96677a21eaeffc98445862  ruby-docs-1.6.8-9.EL3.3.x86_64.rpm
f1b99550c731bb413f8f22bf2af6da95  ruby-libs-1.6.8-9.EL3.3.x86_64.rpm
4900c7792a3c986a8cfcb1ea78ce6045  ruby-mode-1.6.8-9.EL3.3.x86_64.rpm
81255d577d75df37f37461811121aa0e  ruby-tcltk-1.6.8-9.EL3.3.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/ruby-1.6.8-9.EL3.3.src.rpm
2f01d4591ff0fc041a544a7903b1808d  ruby-1.6.8-9.EL3.3.src.rpm

i386:
f408badb2510f463b5c7872e69a90efc  irb-1.6.8-9.EL3.3.i386.rpm
28689571cc04893ae54659d3bd50600f  ruby-1.6.8-9.EL3.3.i386.rpm
6f58c9789a0215e620b07761864d49e1  ruby-devel-1.6.8-9.EL3.3.i386.rpm
f2989414a97a41d85efa0386cfd6e63d  ruby-docs-1.6.8-9.EL3.3.i386.rpm
645e9618992229a97d7e1de2dbb5c691  ruby-libs-1.6.8-9.EL3.3.i386.rpm
f39588cdce470d68cf022ef3d4b7c17d  ruby-mode-1.6.8-9.EL3.3.i386.rpm
58f1aaa85a9bb7ab46a85dd339b57004  ruby-tcltk-1.6.8-9.EL3.3.i386.rpm

ia64:
c592891960b9b93d210b6a83811c847f  irb-1.6.8-9.EL3.3.ia64.rpm
7ac0fee7db9ee459261c63e93546983e  ruby-1.6.8-9.EL3.3.ia64.rpm
33cfff0cc59df6f4bb99c6f10f7cfe42  ruby-devel-1.6.8-9.EL3.3.ia64.rpm
9646d7fac418cec6cbe503f80d61c0c4  ruby-docs-1.6.8-9.EL3.3.ia64.rpm
ac7060784a405a2f2d32c400f20981a9  ruby-libs-1.6.8-9.EL3.3.ia64.rpm
76f778eddc74e655d417cae54b6911ed  ruby-mode-1.6.8-9.EL3.3.ia64.rpm
3a61c755364d2c2fc40235ca174c4109  ruby-tcltk-1.6.8-9.EL3.3.ia64.rpm

x86_64:
8ba124cf1c2c7afb3ad723a20b7d5c0d  irb-1.6.8-9.EL3.3.x86_64.rpm
08fbcb3dbbcc4f6007ff5bb553101e3a  ruby-1.6.8-9.EL3.3.x86_64.rpm
f919fb4d57ac9007db765d15169bb448  ruby-devel-1.6.8-9.EL3.3.x86_64.rpm
9c878a656d96677a21eaeffc98445862  ruby-docs-1.6.8-9.EL3.3.x86_64.rpm
f1b99550c731bb413f8f22bf2af6da95  ruby-libs-1.6.8-9.EL3.3.x86_64.rpm
4900c7792a3c986a8cfcb1ea78ce6045  ruby-mode-1.6.8-9.EL3.3.x86_64.rpm
81255d577d75df37f37461811121aa0e  ruby-tcltk-1.6.8-9.EL3.3.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/ruby-1.6.8-9.EL3.3.src.rpm
2f01d4591ff0fc041a544a7903b1808d  ruby-1.6.8-9.EL3.3.src.rpm

i386:
f408badb2510f463b5c7872e69a90efc  irb-1.6.8-9.EL3.3.i386.rpm
28689571cc04893ae54659d3bd50600f  ruby-1.6.8-9.EL3.3.i386.rpm
6f58c9789a0215e620b07761864d49e1  ruby-devel-1.6.8-9.EL3.3.i386.rpm
f2989414a97a41d85efa0386cfd6e63d  ruby-docs-1.6.8-9.EL3.3.i386.rpm
645e9618992229a97d7e1de2dbb5c691  ruby-libs-1.6.8-9.EL3.3.i386.rpm
f39588cdce470d68cf022ef3d4b7c17d  ruby-mode-1.6.8-9.EL3.3.i386.rpm
58f1aaa85a9bb7ab46a85dd339b57004  ruby-tcltk-1.6.8-9.EL3.3.i386.rpm

ia64:
c592891960b9b93d210b6a83811c847f  irb-1.6.8-9.EL3.3.ia64.rpm
7ac0fee7db9ee459261c63e93546983e  ruby-1.6.8-9.EL3.3.ia64.rpm
33cfff0cc59df6f4bb99c6f10f7cfe42  ruby-devel-1.6.8-9.EL3.3.ia64.rpm
9646d7fac418cec6cbe503f80d61c0c4  ruby-docs-1.6.8-9.EL3.3.ia64.rpm
ac7060784a405a2f2d32c400f20981a9  ruby-libs-1.6.8-9.EL3.3.ia64.rpm
76f778eddc74e655d417cae54b6911ed  ruby-mode-1.6.8-9.EL3.3.ia64.rpm
3a61c755364d2c2fc40235ca174c4109  ruby-tcltk-1.6.8-9.EL3.3.ia64.rpm

x86_64:
8ba124cf1c2c7afb3ad723a20b7d5c0d  irb-1.6.8-9.EL3.3.x86_64.rpm
08fbcb3dbbcc4f6007ff5bb553101e3a  ruby-1.6.8-9.EL3.3.x86_64.rpm
f919fb4d57ac9007db765d15169bb448  ruby-devel-1.6.8-9.EL3.3.x86_64.rpm
9c878a656d96677a21eaeffc98445862  ruby-docs-1.6.8-9.EL3.3.x86_64.rpm
f1b99550c731bb413f8f22bf2af6da95  ruby-libs-1.6.8-9.EL3.3.x86_64.rpm
4900c7792a3c986a8cfcb1ea78ce6045  ruby-mode-1.6.8-9.EL3.3.x86_64.rpm
81255d577d75df37f37461811121aa0e  ruby-tcltk-1.6.8-9.EL3.3.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key.html#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0983

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact.html

Copyright 2004 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFBveYgXlSAg2UNWIIRAqF+AKCc0RlQmBtxOQrsx6h+1YUvCeC3qQCfVlRw
0jSyrFr0i0XTnpYW2VFCQdc=
=qiyt
-----END PGP SIGNATURE-----


-- 
Enterprise-watch-list mailing list
Enterprise-watch-list@redhat.com
https://www.redhat.com/mailman/listinfo/enterprise-watch-list