Lucene search

DebianDEBIAN:DSA-1234-1:2F711

HistoryDec 13, 2006 - 12:12 p.m.

[SECURITY] [DSA-1234-1] New ruby1.6 package fix denial of service

2006-12-1312:12:07

lists.debian.org

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

AI Score

5.9

Confidence

High

EPSS

0.206

Percentile

96.4%

JSON

Debian Security Advisory DSA-1234-1 [email protected]
http://www.debian.org/security/ Steve Kemp
December 13, 2006

Package : ruby1.6 (1.6.8-12sarge3)
Vulnerability : Denial of service
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2006-5467
Debian Bug : 398457

A denial of service vulnerability has been discovered in the CGI library
included with Ruby, the intepreted scripting langauge for quick and easy
object-orientated programming.

For the stable distribution (sarge), this problem has been fixed in version
1.6.8-12sarge3.

We recommend that you upgrade your ruby1.6 package.

Upgrade instructions

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian 3.1 (stable)

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/r/ruby1.6/ruby1.6_1.6.8-12sarge3.dsc
Size/MD5 checksum: 995 afe54a8363d4d14b066f32b07b095dde
http://security.debian.org/pool/updates/main/r/ruby1.6/ruby1.6_1.6.8-12sarge3.diff.gz
Size/MD5 checksum: 78860 73e5ba7c3a427ceb1bf4926cf9e440a9
http://security.debian.org/pool/updates/main/r/ruby1.6/ruby1.6_1.6.8.orig.tar.gz
Size/MD5 checksum: 1022364 aa1e272added83a5206c565d62c9c8ed

Architecture independent packages:

http://security.debian.org/pool/updates/main/r/ruby1.6/ruby1.6-elisp_1.6.8-12sarge3_all.deb
Size/MD5 checksum: 152700 0086c6b5b4d81a689ec8ab938e495e33
http://security.debian.org/pool/updates/main/r/ruby1.6/ruby1.6-examples_1.6.8-12sarge3_all.deb
Size/MD5 checksum: 160374 ad819f654e8b072a38ebbf2e6aa24fd5
http://security.debian.org/pool/updates/main/r/ruby1.6/irb1.6_1.6.8-12sarge3_all.deb
Size/MD5 checksum: 174876 7518ee339c9c8450d13097c25d1ab034

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

m68k architecture (Motorola Mc680x0)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

OSVersionArchitecturePackageVersionFilename
Debian3.1i386ruby1.8-dev< 1.8.2-7sarge5ruby1.8-dev_1.8.2-7sarge5_i386.deb
Debian3.1alphalibruby1.6-dbg< 1.6.8-12sarge3libruby1.6-dbg_1.6.8-12sarge3_alpha.deb
Debian3.1armlibpty-ruby1.6< 1.6.8-12sarge3libpty-ruby1.6_1.6.8-12sarge3_arm.deb
Debian3.1i386libruby1.6-dbg< 1.6.8-12sarge3libruby1.6-dbg_1.6.8-12sarge3_i386.deb
Debian3.1mipslibreadline-ruby1.8< 1.8.2-7sarge5libreadline-ruby1.8_1.8.2-7sarge5_mips.deb
Debian3.1amd64libsyslog-ruby1.6< 1.6.8-12sarge3libsyslog-ruby1.6_1.6.8-12sarge3_amd64.deb
Debian3.1armlibopenssl-ruby1.8< 1.8.2-7sarge5libopenssl-ruby1.8_1.8.2-7sarge5_arm.deb
Debian3.1m68klibreadline-ruby1.8< 1.8.2-7sarge5libreadline-ruby1.8_1.8.2-7sarge5_m68k.deb
Debian3.1armlibsyslog-ruby1.6< 1.6.8-12sarge3libsyslog-ruby1.6_1.6.8-12sarge3_arm.deb
Debian3.1ia64libcurses-ruby1.6< 1.6.8-12sarge3libcurses-ruby1.6_1.6.8-12sarge3_ia64.deb

OS	Version	Architecture	Package	Version	Filename
Debian	3.1	i386	ruby1.8-dev	< 1.8.2-7sarge5	ruby1.8-dev_1.8.2-7sarge5_i386.deb
Debian	3.1	alpha	libruby1.6-dbg	< 1.6.8-12sarge3	libruby1.6-dbg_1.6.8-12sarge3_alpha.deb
Debian	3.1	arm	libpty-ruby1.6	< 1.6.8-12sarge3	libpty-ruby1.6_1.6.8-12sarge3_arm.deb
Debian	3.1	i386	libruby1.6-dbg	< 1.6.8-12sarge3	libruby1.6-dbg_1.6.8-12sarge3_i386.deb
Debian	3.1	mips	libreadline-ruby1.8	< 1.8.2-7sarge5	libreadline-ruby1.8_1.8.2-7sarge5_mips.deb
Debian	3.1	amd64	libsyslog-ruby1.6	< 1.6.8-12sarge3	libsyslog-ruby1.6_1.6.8-12sarge3_amd64.deb
Debian	3.1	arm	libopenssl-ruby1.8	< 1.8.2-7sarge5	libopenssl-ruby1.8_1.8.2-7sarge5_arm.deb
Debian	3.1	m68k	libreadline-ruby1.8	< 1.8.2-7sarge5	libreadline-ruby1.8_1.8.2-7sarge5_m68k.deb
Debian	3.1	arm	libsyslog-ruby1.6	< 1.6.8-12sarge3	libsyslog-ruby1.6_1.6.8-12sarge3_arm.deb
Debian	3.1	ia64	libcurses-ruby1.6	< 1.6.8-12sarge3	libcurses-ruby1.6_1.6.8-12sarge3_ia64.deb