Summary
Ubuntu Update for Linux kernel vulnerabilities USN-596-1
Solution
Please Install the Updated Packages.
Insight
Chris Clark discovered that Ruby's HTTPS module did not check for commonName mismatches early enough during SSL negotiation. If a remote attacker were able to perform man-in-the-middle attacks, this flaw could be exploited to view sensitive information in HTTPS requests coming from Ruby applications. (CVE-2007-5162)
It was discovered that Ruby's FTPTLS, telnets, and IMAPS modules did not check the commonName when performing SSL certificate checks.
If a remote attacker were able to perform man-in-the-middle attacks, this flaw could be exploited to eavesdrop on encrypted communications from Ruby applications using these protocols. (CVE-2007-5770)
Affected
ruby1.8 vulnerabilities on Ubuntu 6.06 LTS ,
Ubuntu 6.10 ,
Ubuntu 7.04 ,
Ubuntu 7.10
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2007-5162, CVE-2007-5770 -
CVSS Base Score: 5.0
AV:N/AC:L/Au:N/C:N/I:P/A:N
Related Vulnerabilities