[Security Announce] [ MDKSA-2006:079 ] - Updated ruby packages fix vulnerability

Posted by Bob on: 04/26/2006 01:52 AM [ Print | 0 comment(s) ]

The Mandriva Security Team published a new security update for Mandriva Linux. Here the announcement:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2006:079
http://www.mandriva.com/security/
_______________________________________________________________________

Package : ruby
Date : April 25, 2006
Affected: 10.2, 2006.0, Corporate 3.0
_______________________________________________________________________

Problem Description:

A vulnerability in how ruby's HTTP module uses blocking sockets was
reported by Yukihiro Matsumoto. By sending large amounts of data to a
server application using this module, a remote attacker could exploit
it to render the application unusable and not respond to other client
requests.

The updated packages have been patched to fix this problem.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1931
_______________________________________________________________________

Updated Packages:

Mandriva Linux 10.2:
f9745c919a26b88653c1bb8d65b22656 10.2/RPMS/ruby-1.8.2-6.3.102mdk.i586.rpm
a70aa5e8d43962a8e1432eba455550a1 10.2/RPMS/ruby-devel-1.8.2-6.3.102mdk.i586.rpm
ef56fa7d95bb07869fd990174fba0a80 10.2/RPMS/ruby-doc-1.8.2-6.3.102mdk.i586.rpm
46cf35ec68925266be3476e0e2244dba 10.2/RPMS/ruby-tk-1.8.2-6.3.102mdk.i586.rpm
9a297ac138f1be885dbf9bdb3f963dca 10.2/SRPMS/ruby-1.8.2-6.3.102mdk.src.rpm

Mandriva Linux 10.2/X86_64:
7a961ba32e721306fc18cc84138131fa x86_64/10.2/RPMS/ruby-1.8.2-6.3.102mdk.x86_64.rpm
6215d5fe2525ddcaf47b22443be40d29 x86_64/10.2/RPMS/ruby-devel-1.8.2-6.3.102mdk.x86_64.rpm
6bf001166ce1fe417513be0da4afa983 x86_64/10.2/RPMS/ruby-doc-1.8.2-6.3.102mdk.x86_64.rpm
dc54e4e1cb352e2a31578b528b0fae24 x86_64/10.2/RPMS/ruby-tk-1.8.2-6.3.102mdk.x86_64.rpm
9a297ac138f1be885dbf9bdb3f963dca x86_64/10.2/SRPMS/ruby-1.8.2-6.3.102mdk.src.rpm

Mandriva Linux 2006.0:
3144dc749cdb9da398064c2cf34103fe 2006.0/RPMS/ruby-1.8.2-7.2.20060mdk.i586.rpm
1bf85e3cd1456dbda21fd95f1626b28f 2006.0/RPMS/ruby-devel-1.8.2-7.2.20060mdk.i586.rpm
80000d9bf73c957174c6ce8a7c637147 2006.0/RPMS/ruby-doc-1.8.2-7.2.20060mdk.i586.rpm
272d3970702ec07e44a0469d1f431380 2006.0/RPMS/ruby-tk-1.8.2-7.2.20060mdk.i586.rpm
5cd34c71849ac8eebe80c6389178a5a8 2006.0/SRPMS/ruby-1.8.2-7.2.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
c032856335423079f3a68b7eeaeda281 x86_64/2006.0/RPMS/ruby-1.8.2-7.2.20060mdk.x86_64.rpm
aa44a1b8179d94c3ef4504d504fdb01b x86_64/2006.0/RPMS/ruby-devel-1.8.2-7.2.20060mdk.x86_64.rpm
a409a90806495d8a074fa15d9191d053 x86_64/2006.0/RPMS/ruby-doc-1.8.2-7.2.20060mdk.x86_64.rpm
4a13e6ade495ac6c2d6068d88674d396 x86_64/2006.0/RPMS/ruby-tk-1.8.2-7.2.20060mdk.x86_64.rpm
5cd34c71849ac8eebe80c6389178a5a8 x86_64/2006.0/SRPMS/ruby-1.8.2-7.2.20060mdk.src.rpm

Corporate 3.0:
249f78bda13201aecd66a30379a23209 corporate/3.0/RPMS/ruby-1.8.1-1.5.C30mdk.i586.rpm
210ae59468330f26d71496c636fc4dcc corporate/3.0/RPMS/ruby-devel-1.8.1-1.5.C30mdk.i586.rpm
a69109163c0cd1c22616dce20e4924cf corporate/3.0/RPMS/ruby-doc-1.8.1-1.5.C30mdk.i586.rpm
cbfdf5cab0ae9c82731a94ef51f60e41 corporate/3.0/RPMS/ruby-tk-1.8.1-1.5.C30mdk.i586.rpm
7db43332f4a6cd0d6f530f2e423315ac corporate/3.0/SRPMS/ruby-1.8.1-1.5.C30mdk.src.rpm

Corporate 3.0/X86_64:
3ec5b89b32196866594ac0fbeb852e66 x86_64/corporate/3.0/RPMS/ruby-1.8.1-1.5.C30mdk.x86_64.rpm
63df0377e01145f410075b7122c1e541 x86_64/corporate/3.0/RPMS/ruby-devel-1.8.1-1.5.C30mdk.x86_64.rpm
54580e762f81bceb21bc62aa7f4f934b x86_64/corporate/3.0/RPMS/ruby-doc-1.8.1-1.5.C30mdk.x86_64.rpm
f8e720ecbeafc2dceb8522272b213e08 x86_64/corporate/3.0/RPMS/ruby-tk-1.8.1-1.5.C30mdk.x86_64.rpm
7db43332f4a6cd0d6f530f2e423315ac x86_64/corporate/3.0/SRPMS/ruby-1.8.1-1.5.C30mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
lt;security*mandriva.comgt;
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)

iD8DBQFEToPBmqjQ0CJFipgRAjYgAJ9tf1nRJZhBInVNILG53lQvy1nTOwCfQtJu
yoIIcgaXpYqbHvIzbKdUL04=
=FxkL
-----END PGP SIGNATURE-----