Inicial ▼ Bookkeeping
Online ▼ Auditorias ▼
DNS
Administrado ▼
Acerca de DNS
Ordenar/Renovar
Preguntas Frecuentes
AUP
Dynamic DNS Clients
Configurar Dominios Dynamic DNS Update Password Monitoreo
de Redes ▼
Enterprise
Avanzado
Estándarr
Prueba
Preguntas Frecuentes
Resumen de Precio/Funciones
Ordenar
Muestras
Configure/Status Alert Profiles | |||
ID de Prueba: | 1.3.6.1.4.1.25623.1.0.902560 |
Categoría: | General |
Título: | Ruby Random Number Values Information Disclosure Vulnerability |
Resumen: | This host is installed with Ruby and is prone to information; disclosure vulnerability. |
Descripción: | Summary: This host is installed with Ruby and is prone to information disclosure vulnerability. Vulnerability Insight: The flaw exists because the SecureRandom.random_bytes function in lib/securerandom.rb relies on PID values for initialization, which makes it easier for context-dependent attackers to predict the result string by leveraging knowledge of random strings obtained in an earlier process with the same PID. Vulnerability Impact: Successful exploits may allow attackers to predict random number values. Affected Software/OS: Ruby versions before 1.8.7-p352 and 1.9.x before 1.9.2-p290. Solution: Upgrade to Ruby version 1.8.7-p352, 1.9.2-p290 or later. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N |
Referencia Cruzada: |
Common Vulnerability Exposure (CVE) ID: CVE-2011-2705 BugTraq ID: 49015 http://www.securityfocus.com/bid/49015 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063071.html http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063062.html http://www.openwall.com/lists/oss-security/2011/07/11/1 http://www.openwall.com/lists/oss-security/2011/07/12/14 http://www.openwall.com/lists/oss-security/2011/07/20/1 http://www.openwall.com/lists/oss-security/2011/07/20/16 http://www.redhat.com/support/errata/RHSA-2011-1581.html |
Copyright | Copyright (C) 2011 Greenbone Networks GmbH |
Esta es sólo una de 99761 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora. |