Ruby Net:::HTTP and Net::HTTPS library man-in-the-middle
| ruby-nethttps-mitm (36861) |  Low Risk |
Description:
The Ruby NET:HTTP and Net::HTTPS libraries could provide weaker than expected security. The connect method in the lib/net/http.rb file does not properly validate the certificate¿s common name (CN) after SSL tunnel negotiation has completed. A remote attacker could masquerade as a valid server and gain unauthorized access to secure data through a man-in-the-middle attack.
*CVSS:
| Base Score: | 5 |
| Access Vector: | Network |
| Access Complexity: | Low |
| Authentication: | None |
| Confidentiality Impact: | Partial |
| Integrity Impact: | None |
| Availability Impact: | None |
| Temporal Score: | 3.9 |
| Exploitability: | Proof-of-Concept |
| Remediation Level: | Official-Fix |
| Report Confidence: | Confirmed |
Consequences:
Other
Remedy:
For Ruby 1.8.5:
Upgrade to the latest version of Ruby (1.8.5, Revision 13502 or later), available from the Ruby Web site. See References.
For Ruby 1.8.6:
Upgrade to the latest version of Ruby (1.8.6, Revision 13504 or later), available from the Ruby Web site. See References.
For other distributions:
Apply the appropriate update for your system. See References.
References:
- BugTraq Mailing List, Thu Sep 27 2007 - 18:01:36 CDT: Ruby Net::HTTPS library does not validate server certificate CN.
- iSEC Partners Security Advisory - 2007-006-RubySSL: Ruby Net::HTTPS library does not validate server certificate CN.
- Ruby Web site: Revision 13502.
- Ruby Web site: Revision 13504.
- ASA-2007-487: Ruby security update (RHSA-2007-0961)
- BID-25847: Ruby Net::HTTP SSL Insecure Certificate Validation Weakness
- CVE-2007-5162: The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.
- DSA-1410: ruby1.8 -- programming error
- DSA-1411: libopenssl-ruby -- programming error
- DSA-1412: ruby1.9 -- programming error
- MDVSA-2008:029: Updated ruby packages fix possible man-in-the-middle attack
- RHSA-2007-0961: Moderate: ruby security update
- RHSA-2007-0965: Moderate: ruby security update
- SA26985: Ruby "Net::HTTPS" Common Name Verification Security Issue
- SUSE-SR:2007:024: SUSE Security Summary Report
- USN-596-1: Ruby vulnerabilities
- VUPEN/ADV-2007-3340: Ruby Net::HTTPS Library Common Name Verification Security Weakness
Platforms Affected:
- Canonical Ubuntu 6.06 LTS
- Canonical Ubuntu 6.10
- Canonical Ubuntu 7.04
- Canonical Ubuntu 7.10
- Debian Debian Linux 3.1
- Debian Debian Linux 4.0
- MandrakeSoft Mandrake Linux 2007 X86_64
- MandrakeSoft Mandrake Linux 2007
- MandrakeSoft Mandrake Linux 2007.1 X86_64
- MandrakeSoft Mandrake Linux 2007.1
- MandrakeSoft Mandrake Linux 2008.0 X86_64
- MandrakeSoft Mandrake Linux 2008.0
- MandrakeSoft Mandrake Linux Corporate Server 3.0
- MandrakeSoft Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft Mandrake Linux Corporate Server 4.0
- MandrakeSoft Mandrake Linux Corporate Server 4.0 X86_64
- RedHat Enterprise Linux 4 Desktop
- RedHat Enterprise Linux 4 WS
- RedHat Enterprise Linux 4 AS
- RedHat Enterprise Linux 4 ES
- RedHat Enterprise Linux 5 Client Workstation
- RedHat Enterprise Linux 5 Client
- RedHat Enterprise Linux 5
- SUSE SuSE Linux
- Yukihiro Matsumoto Ruby 1.8.5
- Yukihiro Matsumoto Ruby 1.8.6
Reported:
Sep 27, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net
* According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall IBM be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.