dawnscanner 1.2.99

data/lib/codesake/dawn/kb/cve_2008_1891.rb

@@ -0,0 +1,40 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_1891
+				include RubyVersionCheck
+
+				def initialize
+          message = "Directory traversal vulnerability in WEBrick in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2, when using NTFS or FAT filesystems, allows remote attackers to read arbitrary CGI files via a trailing (1) + (plus), (2) %2b (encoded plus), (3) . (dot), (4) %2e (encoded dot), or (5) %20 (encoded space) character in the URI, possibly related to the WEBrick::HTTPServlet::FileHandler and WEBrick::HTTPServer.new functionality and the :DocumentRoot option."
+          
+          super({
+            :name=>"CVE-2008-1891",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",
+            :release_date => Date.new(2008, 4, 18),
+            :cwe=>"22",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p2"}, 
+            {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p22"}, 
+            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p230"}, 
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p231"},
+            {:engine=>"ruby", :version=>"1.8.4", :patchlevel=>"p999"},
+            {:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p999"},
+            {:engine=>"ruby", :version=>"1.8.2", :patchlevel=>"p999"},
+            {:engine=>"ruby", :version=>"1.8.1", :patchlevel=>"p999"},
+            {:engine=>"ruby", :version=>"1.8.0", :patchlevel=>"p999"}
+          ]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_2376.rb

@@ -0,0 +1,32 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_2376
+				include RubyVersionCheck
+
+				def initialize
+          message = "Integer overflow in the rb_ary_fill function in array.c in Ruby before revision 17756 allows context-dependent attackers to cause a denial of service (crash) or possibly have unspecified other impact via a call to the Array#fill method with a start (aka beg) argument greater than ARY_MAX_SIZE. NOTE: this issue exists because of an incomplete fix for other closely related integer overflows."
+
+          super({
+            :name=>"CVE-2008-2376",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2008, 7, 9),
+            :cwe=>"189",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.openwall.com/lists/oss-security/2008/07/02/3"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p231"}
+          ]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_2662.rb

@@ -0,0 +1,35 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_2662
+				include RubyVersionCheck
+
+				def initialize
+          message = "Multiple integer overflows in the rb_str_buf_append function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors that trigger memory corruption, a different issue than CVE-2008-2663, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. This CVE description should be regarded as authoritative, although it is likely to change."
+
+          super({
+            :name=>"CVE-2008-2662",
+            :cvss=>"AV:N/AC:L/Au:N/C:C/I:C/A:C",
+            :release_date => Date.new(2008, 6, 24),
+            :cwe=>"189",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p2"}, 
+            {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p22"}, 
+            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p230"}, 
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p231"}
+          ]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_2663.rb

@@ -0,0 +1,34 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_2663
+				include RubyVersionCheck
+
+				def initialize
+          message="Multiple integer overflows in the rb_ary_store function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22 allow context-dependent attackers to execute arbitrary code or cause a denial of service via unknown vectors, a different issue than CVE-2008-2662, CVE-2008-2664, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change."
+
+          super({
+            :name=>"CVE-2008-2663",
+            :cvss=>"AV:N/AC:L/Au:N/C:C/I:C/A:C",
+            :release_date => Date.new(2008, 6, 24),
+            :cwe=>"189",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p2"}, 
+            {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p22"}, 
+            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p230"}, 
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p231"}
+          ]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_2664.rb

@@ -0,0 +1,35 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_2664
+				include RubyVersionCheck
+
+				def initialize
+          message = "The rb_str_format function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, 1.8.7 before 1.8.7-p22, and 1.9.0 before 1.9.0-2 allows context-dependent attackers to trigger memory corruption via unspecified vectors related to alloca, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2725. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change."
+
+           super({
+            :name=>"CVE-2008-2664",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:C",
+            :release_date => Date.new(2008, 6, 24),
+            :cwe=>"399",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p2"}, 
+            {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p22"}, 
+            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p230"}, 
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p231"}
+          ]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_2725.rb

@@ -0,0 +1,33 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_2725
+				include RubyVersionCheck
+
+				def initialize
+          message = "Integer overflow in the (1) rb_ary_splice function in Ruby 1.8.4 and earlier, 1.8.5 before 1.8.5-p231, 1.8.6 before 1.8.6-p230, and 1.8.7 before 1.8.7-p22; and (2) the rb_ary_replace function in 1.6.x allows context-dependent attackers to trigger memory corruption via unspecified vectors, aka the \"REALLOC_N\" variant, a different issue than CVE-2008-2662, CVE-2008-2663, and CVE-2008-2664. NOTE: as of 20080624, there has been inconsistent usage of multiple CVE identifiers related to Ruby. The CVE description should be regarded as authoritative, although it is likely to change."
+          super({
+            :name=>"CVE-2008-2725",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:C",
+            :release_date => Date.new(2008, 6, 24),
+            :cwe=>"189",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p2"}, 
+            {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p22"}, 
+            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p230"}, 
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p231"}
+          ]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_3655.rb

@@ -0,0 +1,39 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_3655
+				include RubyVersionCheck
+
+				def initialize
+          message = "Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not properly restrict access to critical variables and methods at various safe levels, which allows context-dependent attackers to bypass intended access restrictions via (1) untrace_var, (2) $PROGRAM_NAME, and (3) syslog at safe level 4, and (4) insecure methods at safe levels 1 through 3."
+
+          super({
+            :name=>"CVE-2008-3655",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2008, 8, 13),
+            :cwe=>"20",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p0"}, 
+            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p287"}, 
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.4", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.2", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.1", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.0", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.6.999", :patchlevel=>"p0"}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_3657.rb

@@ -0,0 +1,39 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_3657
+				include RubyVersionCheck
+
+				def initialize
+          message = "The dl module in Ruby 1.8.5 and earlier, 1.8.6 through 1.8.6-p286, 1.8.7 through 1.8.7-p71, and 1.9 through r18423 does not check \"taintness\" of inputs, which allows context-dependent attackers to bypass safe levels and execute dangerous functions by accessing a library using DL.dlopen."
+          
+          super({
+            :name=>"CVE-2008-3657",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2008, 8, 13),
+            :cwe=>"20",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p0"}, 
+            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p287"}, 
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.4", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.2", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.1", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.0", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.6.999", :patchlevel=>"p0"}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_3790.rb

@@ -0,0 +1,32 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_3790
+				include RubyVersionCheck
+
+				def initialize
+          message = "The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an \"XML entity explosion.\""
+          super({
+            :name=>"CVE-2008-3790",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
+            :release_date => Date.new(2008, 8, 27),
+            :cwe=>"20",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p73"}, 
+            {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p73"}, 
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p1"} 
+          ]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_3905.rb

@@ -0,0 +1,38 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_3905
+				include RubyVersionCheck
+
+				def initialize
+          message = "resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447."
+          super({
+            :name=>"CVE-2008-3905",
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:P",
+            :release_date => Date.new(2008, 9, 4),
+            :cwe=>"287",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p0"}, 
+            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p287"}, 
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.4", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.2", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.1", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.0", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.6.999", :patchlevel=>"p0"}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_4094.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_4094
+				include DependencyCheck
+
+				def initialize
+          message = "Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer."
+          super({
+            :name=>"CVE-2008-4094",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2008, 9, 30),
+            :cwe=>"89",
+            :owasp=>"A1", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 2.1.1 or higher. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure"]
+          })
+
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['2.1.1', '2.0.999', '1.9.999', '1.2.999', '1.1.999', '0.999.999']}]
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_4310.rb

@@ -0,0 +1,103 @@
+module Codesake
+	module Dawn
+		module Kb
+			class CVE_2008_4310_a
+        include RubyVersionCheck
+        def initialize
+          message = "CVE_2008_4310_a: ruby 1.8.1 and 1.8.5 have problems"
+          super({
+            :name=>"CVE-2008_4310_a",
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+          })
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.8.1", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p999"}
+          ]
+        end
+      end
+
+      class CVE_2008_4310_b
+        include OperatingSystemCheck
+
+        def initialize
+
+          message =  "CVE_2008_4310_b: Only on RedHat EL 4 and 5"
+
+          super({
+            :name=>"CVE-2008_4310_b",
+            :kind=>Codesake::Dawn::KnowledgeBase::OS_CHECK,
+          })
+
+            self.safe_os=[
+              #RHEL 5.10
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-371']},             
+              #RHEL 5.9
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-348']}, 
+              #RHEL 5.8
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-308']},  
+              #RHEL 5.7
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-274']},
+              #RHEL 5.6
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-238']}, 
+              #RHEL 5.5
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-194']}, 
+              #RHEL 5.4            
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-164']}, 
+              #RHEL 5.3 
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-128']},  
+              #RHEL 5.2
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-92']},  
+              #RHEL 5.1
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-53']},   
+              #RHEL 5.0
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-8']}, 
+              #RHEL 4.9           
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-100']},
+              #RHEL 4.8
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-89']}, 
+              #RHEL 4.7
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-78']}, 
+              #RHEL 4.6
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-67']},
+              #RHEL 4.5 
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-55']}, 
+              #RHEL 4.4
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-42']}, 
+              #RHEL 4.3
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-34']}, 
+              #RHEL 4.2
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-22']}, 
+              #RHEL 4.1
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-11']}, 
+              #RHEL 4.0
+              {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-5']}
+            ]
+        end
+      end
+
+			class CVE_2008_4310
+        include ComboCheck
+
+				def initialize
+          message = "httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656."
+          
+          super({
+            :name=>"CVE-2008-4310",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:C",
+            :release_date => Date.new(2008, 12, 9),
+            :cwe=>"399",
+            :owasp=>"A9", 
+            :applies=>["sinatra", "padrino", "rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::COMBO_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade your ruby interpreter",
+            :aux_links=>["http://secunia.com/advisories/33013"],
+            :checks=>[CVE_2008_4310_a.new, CVE_2008_4310_b.new]
+          })
+
+				end
+			end
+		end
+	end
+end
+