Lucene search

K
rubygemsRubySecRUBY:RUBY-2011-2686
HistoryJul 01, 2011 - 8:00 p.m.

Ruby Random Number Generation Local Denial Of Service Vulnerability

2011-07-0120:00:00
RubySec
rubysec.com
9

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

61.9%

Ruby before 1.8.7-p352 does not reset the random seed upon forking, which
makes it easier for context-dependent attackers to predict the values of
random numbers by leveraging knowledge of the number sequence obtained in a
different child process, a related issue to CVE-2003-0900. NOTE: this issue
exists because of a regression during Ruby 1.8.6 development.

CPENameOperatorVersion
rubylt1.8.6.399
rubylt1.8.7.352

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

61.9%