dawnscanner 1.2.99

data/lib/codesake/dawn/kb/cve_2013_3221.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-05-27
+			class CVE_2013_3221
+				include DependencyCheck
+
+				def initialize
+          message = "The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database column is used during comparisons of input values to stored values in that column, which makes it easier for remote attackers to conduct data-type injection attacks against Ruby on Rails applications via a crafted value, as demonstrated by unintended interaction between the \"typed XML\" feature and a MySQL database."
+           super({
+            :name=>"CVE-2013-3221",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:N",
+            :release_date => Date.new(2013, 4, 22),
+            :cwe=>"20",
+            :owasp=>"A9", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 2.3.16, 3.2.9, 3.1.9 or 3.0.21. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["https://groups.google.com/group/rubyonrails-security/msg/1f3bc0b88a60c1ce?dmode=source&output=gplain"]
+          })
+
+          self.safe_dependencies = [{:name=>"railse", :version=>['2.3.16', '3.2.9', '3.1.9', '3.0.21']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4164.rb

@@ -0,0 +1,32 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-11-26
+			class CVE_2013_4164
+				include RubyVersionCheck
+
+        def initialize
+          message = "Any time a string is converted to a floating point value, a specially crafted string can cause a heap overflow. This can lead to a denial of service attack via segmentation faults and possibly arbitrary code execution. Any program that converts input of unknown origin to floating point values (especially common when accepting JSON) are vulnerable."
+
+          super({
+            :name=>"CVE-2013-4164",
+            :cvss=>"not assigned",
+            :release_date => Date.new(2013, 11, 23),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"All users are recommended to upgrade to Ruby 1.9.3 patchlevel 484, ruby 2.0.0 patchlevel 353 or ruby 2.1.0 preview2.",
+            :aux_links=>["https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/"]
+          })
+
+          self.safe_rubies = [{:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"p484"}, {:engine=>"ruby", :version=>"2.0.0", :patchlevel=>"p353"}, 
+            {:engine=>"ruby", :version=>"2.1.0", :patchlevel=>"preview2"}]
+
+				end
+
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4203.rb

@@ -0,0 +1,27 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-03-28
+			class CVE_2013_4203
+				include DependencyCheck
+
+				def initialize
+          message = "The self.run_gpg function in lib/rgpg/gpg_helper.rb in the rgpg gem before 0.2.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors."
+           super({
+            :name=>"CVE-2013-4203",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2013, 10, 11),
+            :cwe=>"94",
+            :owasp=>"A9",
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rgpg at least to version 0.2.3. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://www.openwall.com/lists/oss-security/2013/08/03/2"]
+           })
+           self.safe_dependencies = [{:name=>"rgpg", :version=>['0.2.3']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4389.rb

@@ -0,0 +1,28 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-10-22
+			class CVE_2013_4389
+				include DependencyCheck
+
+				def initialize
+          message = "Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message."
+           super({
+            :name=>'CVE-2013-4389', 
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:N/A:P",  
+            :release_date => Date.new(2013, 10, 17),
+            :cwe=>"134", 
+            :owasp=>"A9",
+            :applies=>["rails"],
+            :kind => Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message => message,
+            :mitigation=>"Please upgrade rails version at least to 3.0.21, 3.1.10 or 3.2.15. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links => ["https://groups.google.com/forum/message/raw?msg=ruby-security-ann/yvlR1Vx44c8/elKJkpO2KVgJ"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['3.0.21', '3.1.10', '3.2.15']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4413.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-02-05
+			class CVE_2013_4413
+				include DependencyCheck
+
+				def initialize
+          message = "Wicked Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed via the 'the_step' parameter upon submission to the render_redirect.rb script. This may allow a remote attacker to gain access to arbitrary files."
+
+          super({
+            :name=>"CVE-2013-4413",
+            :cvss=>"",
+            :release_date => Date.new(2013, 10, 8),
+            :cwe=>"",
+            :owasp=>"A9",
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade wicked version up to version 1.0.1.",
+            :aux_links=>["http://schneems.com/post/63478235238/wicked-1-0-1-released-with-critical-security-fix"]
+          })
+
+          self.safe_dependencies = [{:name=>"wicked", :version=>['1.0.1']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4457.rb

@@ -0,0 +1,31 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-11-26
+			class CVE_2013_4457
+				include DependencyCheck
+
+				def initialize
+          message="The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent attackers to execute arbitrary commands via a crafted has object, related to recursive variable interpolation."
+          super({
+            :name=>"CVE-2013-4457",
+            :cvss=>"not assigned",
+            :release_date => Date.new(2013, 10, 22),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"You must upgrade to cocain gem version 0.5.3 or later",
+            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/3XTGFbAJoTg"]
+          })
+
+          self.save_minor = true
+          self.safe_dependencies = [{:name=>"cocaine", :version=>['0.5.3', '0.4.3', '0.3.0']}]
+
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4478.rb

@@ -0,0 +1,28 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-12-17
+			class CVE_2013_4478
+				include DependencyCheck
+
+				def initialize
+          message = "Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an email attachment."
+          super({
+            :name=>'CVE-2013-4478', 
+            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",  
+            :release_date => Date.new(2013, 12, 7),
+            :cwe=>"94", 
+            :owasp=>"A9",
+            :applies=>["rails", "padrino", "sinatra"],
+            :kind => Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message => message,
+            :mitigation=>"Please upgrade sup rubygem",
+            :aux_links => ["http://www.openwall.com/lists/oss-security/2013/10/30/2"]
+          })
+          self.safe_dependencies = [{:name=>"sup", :version=>['0.13.2.1', '0.14.1.1']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4479.rb

@@ -0,0 +1,28 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-12-17
+			class CVE_2013_4479
+				include DependencyCheck
+
+				def initialize
+          message = "lib/sup/message_chunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the content_type of an email attachment."
+          super({
+            :name=>'CVE-2013-4479', 
+            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",  
+            :release_date => Date.new(2013, 12, 7),
+            :cwe=>"94", 
+            :owasp=>"A9",
+            :applies=>["rails", "padrino", "sinatra"],
+            :kind => Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message => message,
+            :mitigation=>"Please upgrade sup rubygem",
+            :aux_links => ["http://www.openwall.com/lists/oss-security/2013/10/30/2"]
+          })
+          self.safe_dependencies = [{:name=>"sup", :version=>['0.13.2.1', '0.14.1.1']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4489.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-02-05
+			class CVE_2013_4489
+				include DependencyCheck
+
+				def initialize
+          message = "There is a remote code execution vulnerability in the code search feature of GitLab provided by the grit gem."
+
+          super({
+            :name=>"CVE-2013-4489",
+            :cvss=>"",
+            :release_date => Date.new(2013, 11, 4),
+            :cwe=>"",
+            :owasp=>"A9",
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade grit version up to version at least to 5.4.1 or 6.2.3. Using the latest version however is always suggested.",
+            :aux_links=>["http://seclists.org/oss-sec/2013/q4/224"]
+          })
+
+          self.safe_dependencies = [{:name=>"grit", :version=>[ '5.4.1', '6.2.3' ]}]
+          self.not_affected = {:name=>"grit", :version=>['5.1', '5.0', '4.x', '3.x', '2.x', '1.x', '0.x'], :earlier=>true}
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4491.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-12-11
+			class CVE_2013_4491
+				include DependencyCheck
+
+				def initialize
+          message = "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem."
+          
+          super({
+            :name=>"CVE-2013-4491",
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2013, 12, 7),
+            :cwe=>"79",
+            :owasp=>"A9", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails to version 3.2.16 or 4.0.2. As a general rule, using the latest stable version is recommended.",
+            :aux_links=>["https://groups.google.com/forum/message/raw?msg=ruby-security-ann/pLrh6DUw998/bLFEyIO4k_EJ"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['3.2.16', '4.0.2', '3.1.9999', '3.0.9999']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4492.rb

@@ -0,0 +1,31 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-12-11
+			class CVE_2013_4492
+				include DependencyCheck
+
+				def initialize
+          message = "Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem before 0.6.6 for Ruby allows remote attackers to inject arbitrary web script or HTML via a crafted I18n::MissingTranslationData.new call."
+
+          super({
+            :name=>"CVE-2013-4492",
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2013, 12, 7),
+            :cwe=>"79",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade ruby-i18n to version 0.6.6. As a general rule, using the latest stable version is recommended.",
+            :aux_links=>["https://groups.google.com/forum/message/raw?msg=ruby-security-ann/pLrh6DUw998/bLFEyIO4k_EJ"]
+          })
+
+          self.safe_dependencies = [{:name=>"ruby-i18n", :version=>['0.6.6']}]
+
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4562.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-11-26
+			class CVE_2013_4562
+				include DependencyCheck
+
+				def initialize
+          message = "Because of the way that omniauth-facebook supports setting a per-request state parameter by storing it in the session, it is possible to circumvent the automatic CSRF protection. Therefore the CSRF added in 1.4.1 should be considered broken. If you are currently providing a custom state, you will need to store and retrieve this yourself (for example, by using the session store) to use 1.5.0."
+          super({
+            :name=>"CVE-2013-4562",
+            :cvss=>"not assigned",
+            :release_date => Date.new(2013, 11, 14),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"You must upgrade at least to 1.5.0 or later",
+            :aux_links=>["https://groups.google.com/forum/#!msg/ruby-security-ann/-tJHNlTiPh4/9SJxdEWLIawJ"]
+          })
+
+          self.safe_dependencies = [{:name=>"omniauth-facebook", :version=>['1.5.0']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_4593.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-02-06
+			class CVE_2013_4593
+				include DependencyCheck
+
+				def initialize
+          message = "omniauth-facebook Gem for Ruby contains a flaw that is due to the application supporting passing the access token via the URL. This may allow a remote attacker to bypass authentication and authenticate as another user."
+
+          super({
+            :name=>"CVE-2013-4593",
+            :cvss=>"",
+            :release_date => Date.new(2013, 11, 14),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade omniauth-facebook version to version 1.5.1 or higher.",
+            :aux_links=>["http://seclists.org/oss-sec/2013/q4/309"]
+          })
+
+          self.safe_dependencies = [{:name=>"omniauth-facebook", :version=>['1.5.1']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_5647.rb

@@ -0,0 +1,31 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-14
+			class CVE_2013_5647
+				include DependencyCheck
+
+				def initialize
+          message = "lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename."
+
+         super({
+            :name=>"CVE-2013-5647",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2013, 8, 29),
+            :cwe=>"94",
+            :owasp=>"A9", 
+            :applies=>["sinatra", "padrino", "rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade sounder version up to 1.0.1. As a general rule, using the latest stable version is recommended.",
+            :aux_links=>["http://vapid.dhs.org/advisories/sounder-ruby-gem-cmd-inj.html"]
+          })
+
+          self.safe_dependencies = [{:name=>"sounder", :version=>['1.0.2']}]
+          self.save_major = true
+ 
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2013_5671.rb

@@ -0,0 +1,28 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-02-06
+			class CVE_2013_5671
+				include DependencyCheck
+
+				def initialize
+          message = "fog-dragonfly Gem for Ruby contains a flaw that is due to the program failing to properly sanitize input passed via the imagemagickutils.rb script. This may allow a remote attacker to execute arbitrary commands."
+          super({
+            :name=>"CVE-2013-5671",
+            :cvss=>"",
+            :release_date => Date.new(2013, 9, 3),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade fog-dragonfly version up to version 0.8.2.",
+            :aux_links=>["http://seclists.org/fulldisclosure/2013/Sep/18"]
+          })
+          self.safe_dependencies = [{:name=>"fog-dragonfly", :version=>['0.8.3']}]
+
+				end
+			end
+		end
+	end
+end