1. CVE-Search
  2. CVE-2011-3009
ID CVE-2011-3009
Summary Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900.
References
Vulnerable Configurations
  • cpe:2.3:a:ruby-lang:ruby:1.8.6:p110:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.8.6:p110:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:*:p111:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:*:p111:*:*:*:*:*:*
  • cpe:2.3:a:ruby-lang:ruby:1.8.6:p36:*:*:*:*:*:*
    cpe:2.3:a:ruby-lang:ruby:1.8.6:p36:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 29-08-2017 - 01:29)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
redhat via4
advisories
  • bugzilla
    id 730287
    title It's not possible to build ruby package
    oval
    OR
    • comment Red Hat Enterprise Linux must be installed
      oval oval:com.redhat.rhba:tst:20070304026
    • AND
      • comment Red Hat Enterprise Linux 6 is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • OR
        • AND
          • comment ruby is earlier than 0:1.8.7.352-3.el6
            oval oval:com.redhat.rhsa:tst:20111581001
          • comment ruby is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384002
        • AND
          • comment ruby-devel is earlier than 0:1.8.7.352-3.el6
            oval oval:com.redhat.rhsa:tst:20111581003
          • comment ruby-devel is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384006
        • AND
          • comment ruby-docs is earlier than 0:1.8.7.352-3.el6
            oval oval:com.redhat.rhsa:tst:20111581005
          • comment ruby-docs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110910006
        • AND
          • comment ruby-irb is earlier than 0:1.8.7.352-3.el6
            oval oval:com.redhat.rhsa:tst:20111581007
          • comment ruby-irb is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384010
        • AND
          • comment ruby-libs is earlier than 0:1.8.7.352-3.el6
            oval oval:com.redhat.rhsa:tst:20111581009
          • comment ruby-libs is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhba:tst:20193384012
        • AND
          • comment ruby-rdoc is earlier than 0:1.8.7.352-3.el6
            oval oval:com.redhat.rhsa:tst:20111581011
          • comment ruby-rdoc is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110910012
        • AND
          • comment ruby-ri is earlier than 0:1.8.7.352-3.el6
            oval oval:com.redhat.rhsa:tst:20111581013
          • comment ruby-ri is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110910014
        • AND
          • comment ruby-static is earlier than 0:1.8.7.352-3.el6
            oval oval:com.redhat.rhsa:tst:20111581015
          • comment ruby-static is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110910016
        • AND
          • comment ruby-tcltk is earlier than 0:1.8.7.352-3.el6
            oval oval:com.redhat.rhsa:tst:20111581017
          • comment ruby-tcltk is signed with Red Hat redhatrelease2 key
            oval oval:com.redhat.rhsa:tst:20110910018
    rhsa
    id RHSA-2011:1581
    released 2011-12-05
    severity Low
    title RHSA-2011:1581: ruby security, bug fix, and enhancement update (Low)
  • rhsa
    id RHSA-2012:0070
rpms
  • ruby-0:1.8.7.352-3.el6
  • ruby-debuginfo-0:1.8.7.352-3.el6
  • ruby-devel-0:1.8.7.352-3.el6
  • ruby-docs-0:1.8.7.352-3.el6
  • ruby-irb-0:1.8.7.352-3.el6
  • ruby-libs-0:1.8.7.352-3.el6
  • ruby-rdoc-0:1.8.7.352-3.el6
  • ruby-ri-0:1.8.7.352-3.el6
  • ruby-static-0:1.8.7.352-3.el6
  • ruby-tcltk-0:1.8.7.352-3.el6
  • irb-0:1.8.1-18.el4
  • ruby-0:1.8.1-18.el4
  • ruby-0:1.8.5-22.el5_7.1
  • ruby-debuginfo-0:1.8.1-18.el4
  • ruby-debuginfo-0:1.8.5-22.el5_7.1
  • ruby-devel-0:1.8.1-18.el4
  • ruby-devel-0:1.8.5-22.el5_7.1
  • ruby-docs-0:1.8.1-18.el4
  • ruby-docs-0:1.8.5-22.el5_7.1
  • ruby-irb-0:1.8.5-22.el5_7.1
  • ruby-libs-0:1.8.1-18.el4
  • ruby-libs-0:1.8.5-22.el5_7.1
  • ruby-mode-0:1.8.1-18.el4
  • ruby-mode-0:1.8.5-22.el5_7.1
  • ruby-rdoc-0:1.8.5-22.el5_7.1
  • ruby-ri-0:1.8.5-22.el5_7.1
  • ruby-tcltk-0:1.8.1-18.el4
  • ruby-tcltk-0:1.8.5-22.el5_7.1
refmap via4
bid 49126
misc http://redmine.ruby-lang.org/issues/show/4338
mlist [oss-security] 20110720 Re: CVE Request: ruby PRNG fixes
xf ruby-random-number-weak-security(69157)
Last major update 29-08-2017 - 01:29
Published 05-08-2011 - 22:55
Last modified 29-08-2017 - 01:29
Back to Top