dawnscanner 1.2.99

data/lib/codesake/dawn/kb/cve_2013_0162.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-14
+			class CVE_2013_0162
+				include DependencyCheck
+
+				def initialize
+          message = "The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp."
+
+           super({
+            :name=>"CVE-2013-0162",
+            :cvss=>"AV:L/AC:L/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2013, 3, 1),
+            :cwe=>"264",
+            :owasp=>"A9", 
+            :applies=>["sinatra", "padrino", "rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade ruby_parser version to 3.1.1. As a general rule, using the latest stable version is recommended.",
+            :aux_links=>["https://bugzilla.redhat.com/show_bug.cgi?id=892806"]
+          })
+
+          self.safe_dependencies = [{:name=>"ruby_parser", :version=>['1.9999.9999', '2.9999.9999', '3.1.1']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0175.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-05-21
+			class CVE_2013_0175
+				include DependencyCheck
+
+				def initialize
+          message = "multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156."
+
+           super({
+            :name=>'CVE-2013-0175', 
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",  
+            :release_date => Date.new(2013, 4, 25),
+            :cwe=>"20", 
+            :owasp=>"A9",
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind => Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message => message,
+            :mitigation=>"Please upgrade multi_xml gem or grape gem",
+            :aux_links => ["https://groups.google.com/forum/?fromgroups=#%21topic/ruby-grape/fthDkMgIOa0"]
+          })
+          self.safe_dependencies = [{:name=>"multi_xml", :version=>['0.5.3']}, {:name=>"grape", :version=>['0.2.6']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0183.rb

@@ -0,0 +1,27 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-02-06
+			class CVE_2013_0183
+				include DependencyCheck
+
+				def initialize
+          message = "multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet."
+          super({
+            :name=>"CVE-2013-0183",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
+            :release_date => Date.new(2013, 3, 1),
+            :cwe=>"119",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rack version up to version 1.3.8 or 1.4.3 or higher.",
+            :aux_links=>["https://groups.google.com/forum/#%21topic/rack-devel/7ZKPNAjgRSs"]
+          })
+          self.safe_dependencies = [{:name=>"rack", :version=>['1.4.3', '1.3.8']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0184.rb

@@ -0,0 +1,27 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-02-06
+			class CVE_2013_0184
+				include DependencyCheck
+
+				def initialize
+          message = "Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to \"symbolized arbitrary strings.\""
+          super({
+            :name=>"CVE-2013-0184",
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:N/A:P",
+            :release_date => Date.new(2013, 3, 1),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rack version up to version 1.4.4, 1.3.9, 1.2.7, 1.1.5 or higher.",
+            :aux_links=>["https://bugzilla.redhat.com/show_bug.cgi?id=895384"]
+          })
+          self.safe_dependencies = [{:name=>"rack", :version=>['1.4.4', '1.3.9', '1.2.7', '1.1.5']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0233.rb

@@ -0,0 +1,28 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-05-21
+			class CVE_2013_0233
+				include DependencyCheck
+
+				def initialize
+          message = "Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before 2.0.5, and 1.5.x before 1.5.4 for Ruby, when using certain databases, does not properly perform type conversion when performing database queries, which might allow remote attackers to cause incorrect results to be returned and bypass security checks via unknown vectors, as demonstrated by resetting passwords of arbitrary accounts."
+          super({
+            :name=>"CVE-2013-0233",
+            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2013, 4, 25),
+            :cwe=>"399",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade Devise gem to version 2.2.3, 2.1.3, 2.0.5, 1.5.4 or latest version available",
+            :aux_links=>["http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/"]
+          })
+
+          self.safe_dependencies = [{:name=>"devise", :version=>['1.5.4', '2.0.5', '2.1.3', '2.2.3']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0256.rb

@@ -0,0 +1,61 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-14
+			class CVE_2013_0256_a
+
+        include DependencyCheck
+
+				def initialize
+          message = "CVE_2013_0256_b: rdoc gem is vulnerable"
+
+          super({
+            :name=>"CVE-2013-0256-b",
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+          })
+
+          self.safe_dependencies = [{:name=>"rdoc", :version=>['2.3.1', '3.13', '4.0.0']}]
+
+        end
+      end
+			class CVE_2013_0256_b
+        include RubyVersionCheck
+        def initialize
+          message = "CVE_2013_0256_b: ruby 1.9.x before 1.9.3-p383 and 2.0.0 before rc2 have problems"
+          super({
+            :name=>"CVE-2013-0256-b",
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+          })
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"p383"}, 
+            {:engine=>"ruby", :version=>"2.0.0", :patchlevel=>"p0"}
+          ]
+        end
+
+
+      end
+
+			class CVE_2013_0256
+				include ComboCheck
+
+				def initialize
+          message = "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL."
+          super({
+            :name=>"CVE-2013-0256",
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2013, 3, 1),
+            :cwe=>"79",
+            :owasp=>"A3", 
+            :applies=>["sinatra", "padrino", "rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::COMBO_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rdoc version at least to 2.3.1, 3.13 or 4.0.0. As a general rule, using the latest stable version is recommended.",
+            :aux_links=>["http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2"],
+            :checks=>[CVE_2013_0256_a.new, CVE_2013_0256_b.new]
+          })
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0262.rb

@@ -0,0 +1,28 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-02-06
+			class CVE_2013_0262
+				include DependencyCheck
+
+				def initialize
+          message = "rack/file.rb (Rack::File) in Rack 1.5.x before 1.5.2 and 1.4.x before 1.4.5 allows attackers to access arbitrary files outside the intended root directory via a crafted PATH_INFO environment variable, probably a directory traversal vulnerability that is remotely exploitable, aka \"symlink path traversals.\""
+          super({
+            :name=>"CVE-2013-0262",
+            :cvss=>"AV:N/AC:M/Au:N/C:P/I:N/A:N",
+            :release_date => Date.new(2013, 2, 8),
+            :cwe=>"22",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rack version up to version 1.5.2 or 1.4.5 or higher.",
+            :aux_links=>["https://groups.google.com/forum/#%21msg/rack-devel/mZsuRonD7G8/DpZIOmMLbOgJ"]
+          })
+          self.save_minor = true
+          self.safe_dependencies = [{:name=>"rack", :version=>['1.5.2', '1.4.5']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0263.rb

@@ -0,0 +1,28 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-14
+			class CVE_2013_0263
+				include DependencyCheck
+
+				def initialize
+          message = "Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time."
+           super({
+            :name=>"CVE-2013-0263",
+            :cvss=>"AV:N/AC:H/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2013, 8, 2),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["sinatra", "padrino", "rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rack version to 1.5.2, 1.4.5, 1.3.10, 1.2.8, 1.1.6. As a general rule, using the latest stable version is recommended.",
+            :aux_links=>["https://groups.google.com/forum/#%21msg/rack-devel/RnQxm6i13C4/xfakH81yWvgJ"]
+          })
+           self.save_minor = true
+           self.safe_dependencies = [{:name=>"rack", :version=>['1.5.2', '1.4.5', '1.3.10', '1.2.8', '1.1.6']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0269.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-05-10
+			class CVE_2013_0269
+				include DependencyCheck
+
+				def initialize
+          message = "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\""
+
+          super({
+            :name=>"CVE-2013-0269",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2013, 2, 13),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade JSON gem to version 1.5.5, 1.6.8 or 1.7.7 or latest version available",
+            :aux_links=>["https://groups.google.com/d/topic/rubyonrails-security/4_YvCpLzL58/discussion"]
+          })
+
+          self.safe_dependencies = [{:name=>"json", :version=>['1.5.5', '1.6.8', '1.7.7']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0276.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-05-16
+			class CVE_2013_0276
+				include DependencyCheck
+
+				def initialize
+          message = "ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request."
+          
+          super({
+            :name=>'CVE-2013-0276', 
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",  
+            :release_date => Date.new(2013, 2, 13),
+            :cwe=>"264", 
+            :owasp=>"A9",
+            :applies=>["rails"],
+            :kind => Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message => message,
+            :mitigation=>"Please upgrade rails version at least to 2.3.17, 3.1.11 and 3.2.12. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links => ["https://groups.google.com/group/rubyonrails-security/msg/bb44b98a73ef1a06?dmode=source&output=gplain"]
+          })
+          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.17', '3.2.12', '3.1.11']}]
+
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0277.rb

@@ -0,0 +1,27 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-05-17
+			class CVE_2013_0277
+				include DependencyCheck
+
+				def initialize
+          message = "ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML."
+          super({
+            :name=>'CVE-2013-0277', 
+            :cvss=>"AV:N/AC:L/Au:N/C:C/I:C/A:C",  
+            :release_date => Date.new(2013, 2, 13),
+            :cwe=>"", 
+            :owasp=>"A9",
+            :applies=>["rails"],
+            :kind => Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message => message,
+            :mitigation=>"Please upgrade rails version at least to 2.3.17 and 3.1.0. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links => ["https://groups.google.com/group/ruby-security-ann/msg/34e0d780b04308de?dmode=source&output=gplain"]
+          })
+          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.17', '3.0.9999999', '3.1.0']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0284.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-05-21
+			class CVE_2013_0284
+				include DependencyCheck
+
+				def initialize
+          message = "Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data."
+          super({
+            :name=>"CVE-2013-0284",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",
+            :release_date => Date.new(2013, 4, 9),
+            :cwe=>"200",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade ruby_agent gem to version 3.5.2 or latest version available",
+            :aux_links=>["https://newrelic.com/docs/ruby/ruby-agent-security-notification"]
+          })
+
+          self.safe_dependencies = [{:name=>"ruby_agent", :version=>['3.5.2']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0285.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-05-21
+			class CVE_2013_0285
+				include DependencyCheck
+
+				def initialize
+          message= "The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156."
+           super({
+            :name=>"CVE-2013-0285",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2013, 4, 9),
+            :cwe=>"20",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade nori gem to version 2.0.2, 1.1.4, 1.0.3 or latest version available",
+            :aux_links=>["https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately"]
+          })
+
+          self.safe_dependencies = [{:name=>"nori", :version=>['1.0.3', '1.1.4', '2.0.2']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_0333.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-04-30
+			class CVE_2013_0333
+				include DependencyCheck
+
+
+				def initialize
+          message = "lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156." 
+          super({
+            :name=>"CVE-2013-0333",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2013, 1, 30),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 2.3.16 or 3.0.20. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/1h2DR63ViGo"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.16', '3.0.20']}]
+          self.aux_mitigation_gem = {:name=>"yajl", :versione=>['any']}
+				end
+			end
+		end
+	end
+end