dawnscanner 1.2.99

data/lib/codesake/dawn/kb/cve_2008_5189.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_5189
+				include DependencyCheck
+
+				def initialize
+          message = "CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function."
+          super({
+            :name=>"CVE-2008-5189",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2008, 11, 21),
+            :cwe=>"352",
+            :owasp=>"A8", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 2.0.5 or higher. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://weblog.rubyonrails.org/2008/10/19/response-splitting-risk"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['2.0.5', '1.9.999', '1.2.999', '1.1.999', '0.999.999']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2008_7248.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2008_7248
+				include DependencyCheck
+
+				def initialize
+          message = "Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain."
+          super({
+            :name=>"CVE-2008-7248",
+            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2009, 12, 16),
+            :cwe=>"20",
+            :owasp=>"A9", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 2.1.3 or 2.2.2 or higher. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['2.1.3', '2.2.2']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2009_4078.rb

@@ -0,0 +1,31 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2009_4078
+				include DependencyCheck
+
+				def initialize
+          message = "Multiple cross-site scripting (XSS) vulnerabilities in Redmine 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
+           super({
+            :name=>"CVE-2009-4078",
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N", 
+            :release_date => Date.new(2009, 11, 25),
+            :cwe=>"79",
+            :owasp=>"A3", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade redmine version at least to 0.8.6 or higher. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://www.redmine.org/wiki/redmine/Changelog#v086-2009-11-04"]
+          })
+
+          self.safe_dependencies = [
+            {:name=>"redmine", :version=>['0.8.5', '0.7.999', '0.6.999', '0.5.999', '0.4.999', '0.3.999', '0.2.999', '0.1.999']}
+          ]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2009_4124.rb

@@ -0,0 +1,32 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2009_4124
+				include RubyVersionCheck
+
+				def initialize
+          message = "Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust, (2) String#center, or (3) String#rjust. NOTE: some of these details are obtained from third party information."
+          super({
+            :name=>"CVE-2009-4124",
+            :cvss=>"AV:N/AC:L/Au:N/C:C/I:C/A:C",
+            :release_date => Date.new(2009, 12, 11),
+            :cwe=>"119",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/"]
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.1", :patchlevel=>"p376"}, 
+          ]
+
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2009_4214.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2009_4214
+				include DependencyCheck
+
+				def initialize
+          message = "Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb."
+          super({
+            :name=>"CVE-2009-4214",
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2009, 12, 7),
+            :cwe=>"79",
+            :owasp=>"A3", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 2.3.5 or higher. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0ab?pli=1"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.5', '2.2.999', '2.1.999', '1.999.999', '0.999.999']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2010_1330.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-07-09
+			class CVE_2010_1330
+				include RubyVersionCheck
+
+				def initialize
+           message="The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string."
+           super({
+            :name=>"CVE-2010-1330",
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2012, 11, 23),
+            :cwe=>"79",
+            :owasp=>"A3", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+            :message=>message,
+            :mitigation=>"Upgrade your jruby interpreter",
+            :aux_links=>["http://www.jruby.org/2010/04/26/jruby-1-4-1-xss-vulnerability.html"]
+          })
+
+          self.safe_rubies = [{:engine=>"jruby", :version=>"1.4.2", :patchlevel=>"p0"}]
+
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2010_2489.rb

@@ -0,0 +1,62 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-09
+			class CVE_2010_2489_a
+        include RubyVersionCheck
+        
+        def initialize
+          message =  "CVE_2010_2489_a: ruby 1.9.2-p429  has problems"
+          super({
+            :name=>"CVE_2010_2489_a",
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+          })
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.2", :patchlevel=>"p430"},
+            {:engine=>"ruby", :version=>"1.9.1", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p999"} 
+          ]
+        end
+      end
+
+      class CVE_2010_2489_b
+        include OperatingSystemCheck
+        def initialize
+          message =  "CVE_2010_2489_a: Only on Windows"
+          super({
+            :name=>"CVE_2010_2489_ab",
+            :kind=>Codesake::Dawn::KnowledgeBase::OS_CHECK,
+          })
+
+          self.safe_os = [
+            {:family=>"windows", :vendor=>"microsoft", :version=>['none']}
+          ]
+
+        end
+
+      end
+
+			class CVE_2010_2489
+				include ComboCheck
+
+				def initialize
+          message = "Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a crafted ARGF.inplace_mode value that is not properly handled when constructing the filenames of the backup files"
+          super({
+            :name=>"CVE-2010-2489",
+            :cvss=>"AV:L/AC:L/Au:N/C:C/I:C/A:C",
+            :release_date => Date.new(2010, 7, 10),
+            :cwe=>"119",
+            :owasp=>"A9", 
+            :applies=>["sinatra", "padrino", "rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::COMBO_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade your ruby interpreter",
+            :aux_links=>["http://www.ruby-lang.org/en/news/2010/07/02/ruby-1-9-1-p429-is-released/"],
+            :checks=>[CVE_2010_2489_a.new, CVE_2010_2489_b.new]
+          })
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2010_3933.rb

@@ -0,0 +1,29 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-08
+			class CVE_2010_3933
+				include DependencyCheck
+
+				def initialize
+          message = "Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs."
+          super({
+            :name=>"CVE-2010-3933",
+            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2010, 10, 28),
+            :cwe=>"20",
+            :owasp=>"A9", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 2.3.10, 3.0.1 or higher. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["ttp://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.10', '3.0.1']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2011_0188.rb

@@ -0,0 +1,69 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-08
+
+			class CVE_2011_0188_a
+        include RubyVersionCheck
+        
+        def initialize
+
+          message =  "CVE_2011_0188_a: ruby 1.9.2-p136 and earlier has problems"
+
+          super({
+            :name=>"CVE-2011-0995_a",
+            :kind=>Codesake::Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
+          })
+
+          self.safe_rubies = [
+            {:engine=>"ruby", :version=>"1.9.2", :patchlevel=>"p137"}, 
+            {:engine=>"ruby", :version=>"1.9.1", :patchlevel=>"p999"}, 
+            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p999"} 
+          ]
+        end
+      end
+
+      class CVE_2011_0188_b
+        include OperatingSystemCheck
+        def initialize
+
+        message =  "CVE_2011_0188_b: Only on Mac OS X 10.6.7 and earlier"
+
+        super({
+            :name=>"CVE-2011-0188_b",
+            :kind=>Codesake::Dawn::KnowledgeBase::OS_CHECK,
+          })
+
+          self.safe_os = [
+            {:family=>"osx", :vendor=>"apple", :version=>['10.6.8']},
+            {:family=>"osx", :vendor=>"apple", :version=>['10.5.9']}
+          ]
+
+        end
+
+      end
+			class CVE_2011_0188
+        include ComboCheck
+
+				def initialize
+          message = "The VpMemAlloc function in bigdecimal.c in the BigDecimal class in Ruby 1.9.2-p136 and earlier, as used on Apple Mac OS X before 10.6.7 and other platforms, does not properly allocate memory, which allows context-dependent attackers to execute arbitrary code or cause a denial of service (application crash) via vectors involving creation of a large BigDecimal value within a 64-bit process, related to an \"integer truncation issue.\""
+
+           super({
+            :name=>"CVE-2011-0188",
+            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2011, 3, 23),
+            :cwe=>"189",
+            :owasp=>"A9", 
+            :applies=>["sinatra", "padrino", "rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::COMBO_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade your ruby interpreter",
+            :aux_links=>["https://bugzilla.redhat.com/show_bug.cgi?id=682332"],
+            :checks=>[CVE_2011_0188_a.new, CVE_2011_0188_b.new]
+          })
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2011_0446.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-07-09
+			class CVE_2011_0446
+				include DependencyCheck
+
+				def initialize
+          message = "Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value. Please note that victim must voluntarily interact with attack mechanism"
+
+          super({
+            :name=>"CVE-2011-0446",
+            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2011, 2, 14),
+            :cwe=>"79",
+            :owasp=>"A3", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 2.3.11 or 3.0.4 or higher. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://groups.google.com/group/rubyonrails-security/msg/365b8a23b76a6b4a?dmode=source&output=gplain"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.12', '3.0.5']}]
+
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2011_0447.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2013-05-29
+			class CVE_2011_0447
+				include DependencyCheck
+
+				def initialize
+          message = "Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage \"combinations of browser plugins and HTTP redirects,\" a related issue to CVE-2011-0696."
+
+          super({
+            :name=>"CVE-2011-0447",
+            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2011, 2, 14),
+            :cwe=>"352",
+            :owasp=>"A9", 
+            :applies=>["rails"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade rails version at least to 2.3.11 or 3.0.4. As a general rule, using the latest stable rails version is recommended.",
+            :aux_links=>["http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails"]
+          })
+
+          self.safe_dependencies = [{:name=>"rails", :version=>['2.1.9999', '2.2.9999', '2.3.11', '3.0.4']}]
+ 
+				end
+			end
+		end
+	end
+end

data/lib/codesake/dawn/kb/cve_2011_0739.rb

@@ -0,0 +1,30 @@
+module Codesake
+	module Dawn
+		module Kb
+			# Automatically created with rake on 2014-01-08
+			class CVE_2011_0739
+				include DependencyCheck
+
+				def initialize
+          message = "The deliver function in the sendmail delivery agent (lib/mail/network/delivery_methods/sendmail.rb) in Ruby Mail gem 2.2.14 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an e-mail address."
+          super({
+            :name=>"CVE-2011-0739",
+            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",
+            :release_date => Date.new(2011, 2, 2),
+            :cwe=>"20",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Codesake::Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade mail to version 2.2.15. As a general rule, using the latest stable version is recommended.",
+            :aux_links=>["http://groups.google.com/group/mail-ruby/browse_thread/thread/e93bbd05706478dd?pli=1"]
+          })
+
+          self.safe_dependencies = [
+            {:name=>"mail", :version=>['1.99.99', '2.2.15']}
+          ]
+				end
+			end
+		end
+	end
+end