Ruby Random Number Values Security Weakness
BID:49126
Info
Ruby Random Number Values Security Weakness
| Bugtraq ID: | 49126 |
| Class: | Design Error |
| CVE: |
CVE-2011-3009 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 29 2011 12:00AM |
| Updated: | May 27 2013 04:34PM |
| Credit: | Eric Wong |
| Vulnerable: |
Yukihiro Matsumoto Ruby 1.8.6 Yukihiro Matsumoto Ruby 1.8.5 -p231 Yukihiro Matsumoto Ruby 1.8.5 -p230 Yukihiro Matsumoto Ruby 1.8.5 -p2 Yukihiro Matsumoto Ruby 1.8.5 -p115 Yukihiro Matsumoto Ruby 1.8.5 Yukihiro Matsumoto Ruby 1.8.4 Yukihiro Matsumoto Ruby 1.8.3 Yukihiro Matsumoto Ruby 1.8.2 pre4 Yukihiro Matsumoto Ruby 1.8.2 pre3 Yukihiro Matsumoto Ruby 1.8.2 pre2 Yukihiro Matsumoto Ruby 1.8.2 pre1 Yukihiro Matsumoto Ruby 1.8.2 Yukihiro Matsumoto Ruby 1.8.1 Yukihiro Matsumoto Ruby 1.8 Yukihiro Matsumoto Ruby 1.6.8 Yukihiro Matsumoto Ruby 1.6.7 Yukihiro Matsumoto Ruby 1.6 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Enterprise Linux Desktop version 4 Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux 5 Server Oracle Enterprise Linux 5 Oracle Enterprise Linux 4 Avaya Aura System Manager 6.2 Avaya Aura System Manager 6.1.3 Avaya Aura System Manager 6.1.2 Avaya Aura System Manager 6.1.1 Avaya Aura System Manager 6.1 SP2 Avaya Aura System Manager 6.1 Sp1 Avaya Aura System Manager 6.1 |
| Not Vulnerable: |
Yukihiro Matsumoto Ruby 1.8.6 -p114 |
Discussion
Ruby Random Number Values Security Weakness
Ruby is prone to a security weakness.
An attacker can exploit this weakness to predict random number values.
Versions prior to Ruby 1.8.6-p114 are vulnerable.
Ruby is prone to a security weakness.
An attacker can exploit this weakness to predict random number values.
Versions prior to Ruby 1.8.6-p114 are vulnerable.
Exploit / POC
Ruby Random Number Values Security Weakness
Attackers exploit this issue with standard network utilities.
Attackers exploit this issue with standard network utilities.
Solution / Fix
Ruby Random Number Values Security Weakness
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
Ruby Random Number Values Security Weakness
References:
References:
- random number generator not reseeded after fork in 1.8 (Ruby)
- Ruby Homepage (Yukihiro Matsumoto)
- ruby security update (RHSA-2012-0070) (Avaya)