SB2015061601 - Amazon Linux AMI update for ruby22

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2015061601

SB2015061601 - Amazon Linux AMI update for ruby22

Published: June 16, 2015

Security Bulletin ID SB2015061601
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Security Features (CVE-ID: CVE-2015-3900)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

RubyGems 2.0.x before 2.0.16, 2.2.x before 2.2.4, and 2.4.x before 2.4.7 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record, aka a "DNS hijack attack."


2) Input validation error (CVE-ID: CVE-2015-4020)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack." NOTE: this vulnerability exists because to an incomplete fix for CVE-2015-3900.


Remediation

Install update from vendor's website.

References