dawnscanner 1.2.99

data/lib/codesake/dawn/kb/cve_2006_2582.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-07
+			class CVE_2006_2582
+				include DependencyCheck
+
+				def initialize
+          message = "The editing form in RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to execute arbitrary Ruby code via unknown attack vectors."
+          super({
+            :name=>"CVE-2006-2582",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2006, 5, 25),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rwiki to version 2.1.0 or above",
+            :aux_links=>["http://secunia.com/advisories/20264"]
+          })
+
+          self.safe_dependencies = [{:name=>"rwiki", :version=>['2.1.0']}]
+
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2006_3694.rb

@@ -0,0 +1,31 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-07
+			class CVE_2006_3694
+				include RubyVersionCheck
+
+				def initialize
+          message = "Multiple unspecified vulnerabilities in Ruby before 1.8.5 allow remote attackers to bypass \"safe level\" checks via unspecified vectors involving (1) the alias function and (2) \"directory operations\"."
+         super({
+            :name=>"CVE-2006-3694",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:N",
+            :release_date => Date.new(2006, 7, 21),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.securityfocus.com/bid/18944"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p0"}
+          ]
+ 
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2006_4112.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-07
+			class CVE_2006_4112
+				include DependencyCheck
+
+				def initialize
+          message = "Unspecified vulnerability in the \"dependency resolution mechanism\" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or \"data loss,\" a different vulnerability than CVE-2006-4111."
+           super({
+            :name=>"CVE-2006-4112",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2006, 8, 14),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 1.1.6 or higher. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['1.1.6']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2006_5467.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-07
+			class CVE_2006_5467
+				include RubyVersionCheck
+
+				def initialize
+          message = "The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a \"-\" instead of \"--\" and contains an inconsistent ID."
+
+           super({
+            :name=>"CVE-2006-5467",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
+            :release_date => Date.new(2006, 10, 27),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.securityfocus.com/bid/20777"]
+          })
+
+          self.safe_rubies = [{:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p0"}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2006_6303.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-07
+			class CVE_2006_6303
+				include RubyVersionCheck
+
+				def initialize
+          message = "The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of service (infinite loop) via crafted HTTP requests, a different issue than CVE-2006-5467."
+
+          super({
+            :name=>"CVE-2006-6303",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
+            :release_date => Date.new(2006, 12, 6),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/"]
+          })
+
+          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p0"}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2006_6852.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-07
+			class CVE_2006_6852
+				include DependencyCheck
+
+				def initialize
+          message = "Eval injection vulnerability in tDiary 2.0.3 and 2.1.4.20061127 allows remote authenticated users to execute arbitrary Ruby code via unspecified vectors, possibly related to incorrect input validation by (1) conf.rhtml and (2) i.conf.rhtml. NOTE: some of these details are obtained from third party information."
+          super({
+            :name=>"CVE-2006-6852",
+            :cvss=>"AV:N/AC:M/Au:S/C:P/I:P/A:P",
+            :release_date => Date.new(2006, 12, 31),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade tdiary version to the latest version.",
+            :aux_links=>["http://www.tdiary.org/20061210.html"]
+          })
+
+          self.safe_dependencies = [{:name=>"tdiary", :version=>['2.0.4', '2.1.5']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2006_6979.rb

@@ -0,0 +1,31 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-07
+			class CVE_2006_6979
+				include DependencyCheck
+
+				def initialize
+          message = "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."
+
+          super({
+            :name=>"CVE-2006-6979",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2007, 2, 8),
+            :cwe=>"20",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"It seems there is no real workaround but not using amarok in your project. If it's needed, please sanitize your code before passing input to Magnatune component",
+            :aux_links=>["http://www.securityfocus.com/bid/22568"]
+          })
+
+          self.safe_dependencies = [{:name=>"amarok", :version=>['999.999.999']}]
+
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2007_0469.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-07
+			class CVE_2007_0469
+				include DependencyCheck
+
+				def initialize
+          message = "The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages."
+           super({
+            :name=>"CVE-2007-0469",
+            :cvss=>"AV:N/AC:M/Au:N/C:C/I:C/A:C",
+            :release_date => Date.new(2007, 1, 24),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"This vulnerability should never occur due to the rubygem evolution. However if it has been found, please upgrade your whole development environment ot something newer",
+            :aux_links=>["http://www.securityfocus.com/archive/1/archive/1/458128/100/0/threaded"]
+          })
+
+          self.safe_dependencies = [{:name=>"rubygems", :version=>['0.9.1', '0.8.12']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2007_5162.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2007_5162
+				include RubyVersionCheck
+
+				def initialize
+          message = "The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site."
+
+          super({
+            :name=>"CVE-2007-5162",
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2007, 10, 1),
+            :cwe=>"287",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13504"]
+          })
+
+          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p999"}, {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p999"}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2007_5379.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2007_5379
+				include DependencyCheck
+
+				def initialize
+          message = "Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file."
+          super({
+            :name=>"CVE-2007-5379",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",
+            :release_date => Date.new(2007, 10, 19),
+            :cwe=>"200",
+            :owasp=>"A9", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 1.2.4 or higher. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['1.2.4']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2007_5380.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2007_5380
+				include DependencyCheck
+
+				def initialize
+          message = "Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to \"URL-based sessions.\""
+           super({
+            :name=>"CVE-2007-5380",
+            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2007, 10, 19),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 1.2.4 or higher. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['1.2.4']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2007_5770.rb

@@ -0,0 +1,32 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2007_5770
+				include RubyVersionCheck
+
+				def initialize
+          message = "The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site, different components than CVE-2007-5162."
+          super({
+            :name=>"CVE-2007-5770",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2007, 11, 14),
+            :cwe=>"22",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p999"}
+          ]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2007_6077.rb

@@ -0,0 +1,31 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2007_6077
+				include DependencyCheck
+
+				def initialize
+          message = "The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380. It has been reviewed in 2012 and it affects also 2.3.x, 3.0.x and 3.1.x."
+
+          super({
+            :name=>"CVE-2007-6077",
+            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2007, 11, 21),
+            :cwe=>"362",
+            :owasp=>"A9", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 1.2.7, 2.1.3, 2.3.13, 3.0.15, 3.1.7, 3.2.7 or higher. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://weblog.rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release"]
+          })
+
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['1.2.7', '2.1.3', '2.3.13', '3.0.15', '3.1.7', '3.2.7', '2.0.999', '1.9.999', '1.2.999', '1.1.999', '0.999.999']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2007_6612.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2007_6612
+				include DependencyCheck
+
+				def initialize
+          message = "Directory traversal vulnerability in DirHandler (lib/mongrel/handlers.rb) in Mongrel 1.0.4 and 1.1.x before 1.1.3 allows remote attackers to read arbitrary files via an HTTP request containing double-encoded sequences (\".%252e\")."
+
+          super({
+            :name=>"CVE-2007-6612",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:N",
+            :release_date => Date.new(2008, 3, 1),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade mongrel to version 1.1.3 or above",
+            :aux_links=>["http://www.securityfocus.com/bid/27133"]
+          })
+
+          self.safe_dependencies = [{:name=>"mongrel", :version=>['1.1.3']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_1145.rb

@@ -0,0 +1,40 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_1145
+				include RubyVersionCheck
+
+				def initialize
+          message = "Directory traversal vulnerability in WEBrick in Ruby 1.8 before 1.8.5-p115 and 1.8.6-p114, and 1.9 through 1.9.0-1, when running on systems that support backslash (\) path separators or case-insensitive file names, allows remote attackers to access arbitrary files via (1) \"..%5c\" (encoded backslash) sequences or (2) filenames that match patterns in the :NondisclosureName option."
+          super({
+            :name=>"CVE-2008-1145",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",
+            :release_date => Date.new(2008, 3, 4),
+            :cwe=>"22",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p2"}, 
+            {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p22"}, 
+            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p114"}, 
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p115"},
+            {:engine=>"ruby", :version=>"1.8.4", :patchlevel=>"p999"},
+            {:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p999"},
+            {:engine=>"ruby", :version=>"1.8.2", :patchlevel=>"p999"},
+            {:engine=>"ruby", :version=>"1.8.1", :patchlevel=>"p999"},
+            {:engine=>"ruby", :version=>"1.8.0", :patchlevel=>"p999"},
+            {:engine=>"ruby", :version=>"1.6.999", :patchlevel=>"p999"}
+          ]
+
+				end
+			end
+		end
+	end
+end