Ruby Net:::HTTP and Net::HTTPS library man-in-the-middle
| ruby-nethttps-mitm (36861) |  Low Risk |
Description:
The Ruby NET:HTTP and Net::HTTPS libraries could provide weaker than expected security. The connect method in the lib/net/http.rb file does not properly validate the certificate¿s common name (CN) after SSL tunnel negotiation has completed. A remote attacker could masquerade as a valid server and gain unauthorized access to secure data through a man-in-the-middle attack.
Platforms Affected:
- Canonical, Ubuntu 6.06 LTS
- Canonical, Ubuntu 6.10
- Canonical, Ubuntu 7.04
- Canonical, Ubuntu 7.10
- Debian, Debian Linux 3.1
- Debian, Debian Linux 4.0
- MandrakeSoft, Mandrake Linux 2007
- MandrakeSoft, Mandrake Linux 2007 X86_64
- MandrakeSoft, Mandrake Linux 2007.1 X86_64
- MandrakeSoft, Mandrake Linux 2007.1
- MandrakeSoft, Mandrake Linux 2008.0
- MandrakeSoft, Mandrake Linux 2008.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 5
- RedHat, Enterprise Linux 5 Client
- RedHat, Enterprise Linux 5 Client Workstation
- SuSE, SuSE Linux
- Yukihiro Matsumoto, Ruby 1.8.5
- Yukihiro Matsumoto, Ruby 1.8.6
Remedy:
For Ruby 1.8.5:
Upgrade to the latest version of Ruby (1.8.5, Revision 13502 or later), available from the Ruby Web site. See References.
For Ruby 1.8.6:
Upgrade to the latest version of Ruby (1.8.6, Revision 13504 or later), available from the Ruby Web site. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Other
References:
- BugTraq Mailing List, Thu Sep 27 2007 - 18:01:36 CDT, Ruby Net::HTTPS library does not validate server certificate CN at http://archives.neohapsis.com/archives/bugtraq/2007-09/0395.html.
- iSEC Partners Security Advisory - 2007-006-RubySSL, Ruby Net::HTTPS library does not validate server certificate CN at http://www.isecpartners.com/advisories/2007-006-rubyssl.txt.
- Ruby Web site, Revision 13502 at http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13502.
- Ruby Web site, Revision 13504 at http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13504.
- ASA-2007-487: Ruby security update (RHSA-2007-0961)
- BID-25847: Ruby Net::HTTP SSL Insecure Certificate Validation Weakness
- CVE-2007-5162: The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.
- DSA-1410: ruby1.8 -- programming error
- DSA-1411: libopenssl-ruby -- programming error
- DSA-1412: ruby1.9 -- programming error
- FrSIRT/ADV-2007-3340: Ruby Net::HTTPS Library Common Name Verification Security Weakness
- MDVSA-2008:029: Updated ruby packages fix possible man-in-the-middle attack
- RHSA-2007-0961: Moderate: ruby security update
- RHSA-2007-0965: Moderate: ruby security update
- SA26985: Ruby "Net::HTTPS" Common Name Verification Security Issue
- SUSE-SR:2007:024: SUSE Security Summary Report
- USN-596-1: Ruby vulnerabilities
Reported:
Sep 27, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net