Login
Newsletter
Werbung

Sicherheit: Denial of Service in Ruby
Aktuelle Meldungen Distributionen
Name: Denial of Service in Ruby
ID: USN-2412-1
Distribution: Ubuntu
Plattformen: Ubuntu 12.04 LTS, Ubuntu 14.04 LTS, Ubuntu 14.10
Datum: Fr, 21. November 2014, 00:55
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8090
Applikationen: Ruby

Originalnachricht

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============4713184811064803777==
Content-Type: multipart/signed; micalg=pgp-sha512;
protocol="application/pgp-signature";
boundary="4BHNeXERspDoi0mgnUuaHPkAtQeIKMMme"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--4BHNeXERspDoi0mgnUuaHPkAtQeIKMMme
Content-Type: text/plain; charset=utf-
Content-Transfer-Encoding: quoted-printable

==========================================================================
Ubuntu Security Notice USN-2412-1
November 20, 2014

ruby1.8, ruby1.9.1, ruby2.0, ruby2.1 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 14.10
- Ubuntu 14.04 LTS
- Ubuntu 12.04 LTS

Summary:

Ruby could be made to consume resources.

Software Description:
- ruby2.0: Object-oriented scripting language
- ruby2.1: Object-oriented scripting language
- ruby1.9.1: Object-oriented scripting language
- ruby1.8: Object-oriented scripting language

Details:

Tomas Hoger discovered that Ruby incorrectly handled XML entity expansion.
An attacker could use this flaw to cause Ruby to consume large amounts of
resources, resulting in a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
libruby2.0 2.0.0.484+really457-3ubuntu1.2
libruby2.1 2.1.2-2ubuntu1.2
ruby2.0 2.0.0.484+really457-3ubuntu1.2
ruby2.1 2.1.2-2ubuntu1.2

Ubuntu 14.04 LTS:
libruby1.9.1 1.9.3.484-2ubuntu1.2
libruby2.0 2.0.0.484-1ubuntu2.2
ruby1.9.1 1.9.3.484-2ubuntu1.2
ruby2.0 2.0.0.484-1ubuntu2.2

Ubuntu 12.04 LTS:
libruby1.8 1.8.7.352-2ubuntu1.6
libruby1.9.1 1.9.3.0-1ubuntu2.10
ruby1.8 1.8.7.352-2ubuntu1.6
ruby1.9.1 1.9.3.0-1ubuntu2.10

In general, a standard system update will make all the necessary changes.

References:
http://www.ubuntu.com/usn/usn-2412-1
CVE-2014-8090

Package Information:
https://launchpad.net/ubuntu/+source/ruby2.0/2.0.0.484+really457-3ubuntu1.2
https://launchpad.net/ubuntu/+source/ruby2.1/2.1.2-2ubuntu1.2
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.484-2ubuntu1.2
https://launchpad.net/ubuntu/+source/ruby2.0/2.0.0.484-1ubuntu2.2
https://launchpad.net/ubuntu/+source/ruby1.8/1.8.7.352-2ubuntu1.6
https://launchpad.net/ubuntu/+source/ruby1.9.1/1.9.3.0-1ubuntu2.10



--4BHNeXERspDoi0mgnUuaHPkAtQeIKMMme
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJUbhveAAoJEGVp2FWnRL6TGiwP/2LlOfWyI219FrwTX6r4jrnI
9KP3A9/4DykfrWCQBpiMF6rz9QiEC7aF4H0/9ec9fN32FiGxxdcBa92ftEimhLiT
4ZzLN2xYrxiGtCDWDKRISa7Op/DjXRSSTjiIl6kE542ZNIqOHkSuflc1dID/yzrn
SpIMkPjzj97728Dl2XbG+DLq01n5tKOjS8y2g8XHEdM8yWXOLTSOatLL2ZSqe8yz
y9nKGasvJGBMR+Hoz3L+NWZ0/ZBH7WcNw6n5o3p0FUdG/bv506/gkWLvDHP2DCsw
XwA7IW1IaHm7tc1VPmWHg//EG1M4OENbezxEqkeUCf9y/TdIzUtKYEffg79L5x9z
l3qKvtUAWplhRoON/ag4e6gmBxSTvl2eqd77FKOciI/SdYTlF7mZA/jLzx+sXcVY
9O9yb7VdaIfUjZJheTjJlbID8FHC6Hcb5IfOyGfqTiwfw1LTDJpGQ+kPwAQmr/g3
dsfbBa1xm1k68y16rnrnsGa5KVBP3ypE57Cts/2PJZOcosWfQyQC50Oy6Yxz8DvD
nMSrv+jEE0DyZR1AScZNyoCg5+TE/GRhsVGBD8HC9vzK9+XW0s9KATGOvIT3EiSq
VP8G4PZtAp4LZmdfKKH7+bkVkAy6WMGaJfFJ03CDXUVNWmipaWqeI8RbSX+gJnTT
n6z7sJP0fMNy0YyeLOgb
=1rHT
-----END PGP SIGNATURE-----

--4BHNeXERspDoi0mgnUuaHPkAtQeIKMMme--


--===============4713184811064803777==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce

--===============4713184811064803777==--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung