dawnscanner 1.6.2 → 1.6.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 970e93679f0ac361a19a2e761c8918f91b80686e
-  data.tar.gz: 8ad5519fc5d4ad77eb1d3d771756a9116cede2a0
+  metadata.gz: 33c6d0a08fb962b05e2bbaaef34304fcc515d532
+  data.tar.gz: d717d82436f1e27eb7b45d6e8a69c9c9123b7361
 SHA512:
-  metadata.gz: 1aad748210b7509d5a13cf0c84eb82054bdf6cb54fed4775613de32a202acc2107f612f2b6e05b85e92269887883daadb7ace0676862c117f5170a4a953012b2
-  data.tar.gz: 46d1200055f2f5db08aa2bcc1e8a211a5025ff6c907f87568360696031c761589deef850b38388651d6fd1b6df3749c9604d79bbe35b8fbdfbd2f66103868c48
+  metadata.gz: 8860de757761b8caee9ae1c72fc6fc20242ad8e4a510e345bc9b444e2e25951bbb5fc2e5fbc9db2bc9ac1bde28f393d45c99fbf23d6ddd7e3509f9681f3f928f
+  data.tar.gz: 92a9113bb0af039a98f822b6fc74936fb2f581e1a2e4ca7775c7483a6ee68b39c1f543c144d0ac7c12aecd4e07e3c953f3d7bf36211e65836ff48437cc3472d3

data/Changelog.md

@@ -7,6 +7,15 @@ frameworks.
 
 _latest update: Tue Mar  1 23:11:10 CET 2016_
 
+## Version 1.6.3 - codename: Tow Mater (2016-09-06)
+
+* Issue #107 - Applying PULL REQUEST from @MKgridSec about CVE-2013-0334 check
+* Issue #196 - Applying PULL REQUEST from @MKgridSec about CVE 2016 0751
+  incorrectly flagged
+* Issue #197 - Applying PULL REQUEST from @MKgridSec about CVE-2016-2098
+  incorrectly flagged
+
+
 ## Version 1.6.2 - codename: Tow Mater (2016-03-02)
 
 * Issue #194 - Adding a check for CVE-2016-2098: Possible remote code execution

data/KnowledgeBase.md

@@ -1,6 +1,6 @@
 # Dawnscanner Knowledge base
 
-The knowledge base library for dawnscanner version 1.6.2 contains 229 security checks.
+The knowledge base library for dawnscanner version 1.6.3 contains 230 security checks.
 ---
 * Simple Form XSS - 20131129: There is a XSS vulnerability on Simple Form's label, hint and error options. When Simple Form creates a label, hint or error message it marks the text as being HTML safe, even though it may contain HTML tags. In applications where the text of these helpers can be provided by the users, malicious values can be provided and Simple Form will mark it as safe.
 * [CVE-2004-0755](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0755): The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions.
@@ -207,6 +207,8 @@ The knowledge base library for dawnscanner version 1.6.2 contains 229 security c
 * CVE-2013-0285: The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
 * [CVE-2013-0333](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0333): lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
 * CVE-2013-0333: lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
+* [CVE-2013-0334](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0334): CVE-2013-0334: Bundler Gem for Ruby Multiple Top-level Source Lines Gemfile Handling Gem Installation Spoofing
+* CVE-2013-0334: CVE-2013-0334: Bundler Gem for Ruby Multiple Top-level Source Lines Gemfile Handling Gem Installation Spoofing
 * [CVE-2013-1607](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1607): PDFKit Gem for Ruby contains a flaw that is due to the program failing to properly validate input during the handling of parameters when generating PDF files. This may allow a remote attacker to potentially execute arbitrary code via the pdfkit generation options.
 * CVE-2013-1607: PDFKit Gem for Ruby contains a flaw that is due to the program failing to properly validate input during the handling of parameters when generating PDF files. This may allow a remote attacker to potentially execute arbitrary code via the pdfkit generation options.
 * [CVE-2013-1655](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1655): Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when
@@ -479,4 +481,4 @@ Setting this to true will essentially strip out any host information.
 This check will analyze the source code looking for the following patterns: XXX, TO_CHECK, CHECKME, CHECK and FIXME
 
 
-_Last updated: Tue 01 Mar 23:13:46 CET 2016_
+_Last updated: Tue 06 Sep 22:42:45 CEST 2016_

data/VERSION

@@ -12,4 +12,4 @@
 # |   "Guido"       |  x.x.0  |
 # |   "Luigi"       |  x.x.0  |
 # | "Doc Hudson"    |  x.x.0  |
-1.6.2 - Tow Mater
+1.6.3 - Tow Mater

data/checksum/dawnscanner-1.6.2.gem.sha1

@@ -0,0 +1 @@
+42e13e8044d521b5d70df913bb979389bd6da028

data/lib/dawn/kb/cve_2013_0334.rb

@@ -0,0 +1,25 @@
+	module Dawn
+		module Kb
+			class CVE_2013_0334
+				include DependencyCheck
+
+				def initialize
+          message = "CVE-2013-0334: Bundler Gem for Ruby Multiple Top-level Source Lines Gemfile Handling Gem Installation Spoofing" 
+          super({
+            :name=>"CVE-2013-0334",
+            :cvss=>"AV:N/AC:L/Au:N/C:N/I:P/A:N",
+            :release_date => Date.new(2014, 8, 13),
+            :cwe=>"",
+            :owasp=>"A9", 
+            :applies=>["rails", "sinatra", "padrino"],
+            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
+            :message=>message,
+            :mitigation=>"Please upgrade bundler gem to 1.7.0 or later",
+            :aux_links=>["http://bundler.io/blog/2014/08/14/bundler-may-install-gems-from-a-different-source-than-expected-cve-2013-0334.html", "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0334"]
+          })
+
+          self.safe_dependencies = [{:name=>"bundler", :version=>['1.7.0']}]
+				end
+			end
+		end
+	end

data/lib/dawn/kb/cve_2015_7577.rb

@@ -20,11 +20,13 @@ module Dawn
             :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
             :message=>message,
             :mitigation=>"Please upgrade activerecord gem to version 3.2.22.1, 4.1.14.1, 4.2.5.1, 5.0.0.beta1.1 or later.",
-            :aux_links=>["http://securitytracker.com/id/1034816"]
+            :aux_links=>["http://securitytracker.com/id/1034816", "https://groups.google.com/forum/#!topic/rubyonrails-security/cawsWcQ6c8g"]
            })
           self.save_minor=true
           self.save_major=true
-          self.safe_dependencies = [{:name=>"activerecord", :version=>['3.2.22.1', '4.1.14.1', '4.2.5.1', '5.0.0.beta1.1']}]
+          self.debug = true
+          self.safe_dependencies = [{:name=>"activerecord", :version=>['3.1.9999','3.2.22.1', '4.1.14.1', '4.2.5.1', '5.0.0.beta1.1']}]
+          self.not_affected = {:name=>"actionpack", :version=>['3.0.x']}
 
 				end
 			end

data/lib/dawn/kb/cve_2016_0751.rb

@@ -22,7 +22,9 @@ module Dawn
             :mitigation=>"Please upgrade actionpack gem to version 3.2.22.1, 4.1.14.1, 4.2.5.1, 5.0.0.beta1.1 or later.",
             :aux_links=>["http://securitytracker.com/id/1034816"]
            })
-          self.safe_dependencies = [{:name=>"actionpack", :version=>['3.2.22.1', '4.1.14.1', '4.2.5.1', '5.0.0.beta1.1']}]
+          self.save_minor=true
+          self.save_major=true
+          self.safe_dependencies = [{:name=>"actionpack", :version=>['3.2.22.1', '4.0.9999', '4.1.14.1', '4.2.5.1', '5.0.0.beta1.1']}]
 
 				end
 			end

data/lib/dawn/kb/cve_2016_2098.rb

@@ -24,9 +24,10 @@ controller or a view may be vulnerable to a code injection."
             :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
             :message=>message,
             :mitigation=>"Please upgrade actionpack gem to version 3.2.22.2, 4.1.14.2, 4.2.5.2, 5.0.0 or later.",
-            :aux_links=>[]
+            :aux_links=>['https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ']
            })
-          self.safe_dependencies = [{:name=>"actionpack", :version=>['3.2.22.2', '4.1.14.2', '4.2.5.2', '5.0.0']}]
+          self.safe_dependencies = [{:name=>"actionpack", :version=>['3.2.22.2', '4.0.9999', '4.1.14.2', '4.2.5.2']}]
+          self.not_affected = {:name=>"actionpack", :version=>['5.0.x']}
 
 				end
 			end

data/lib/dawn/knowledge_base.rb

@@ -152,6 +152,7 @@ require "dawn/kb/cve_2013_0277"
 require "dawn/kb/cve_2013_0284"
 require "dawn/kb/cve_2013_0285"
 require "dawn/kb/cve_2013_0333"
+require "dawn/kb/cve_2013_0334"
 require "dawn/kb/cve_2013_1607"
 require "dawn/kb/cve_2013_1655"
 require "dawn/kb/cve_2013_1656"
@@ -465,6 +466,7 @@ module Dawn
           Dawn::Kb::CVE_2013_0284.new,
           Dawn::Kb::CVE_2013_0285.new,
           Dawn::Kb::CVE_2013_0333.new,
+          Dawn::Kb::CVE_2013_0334.new,
           Dawn::Kb::CVE_2013_1607.new,
           Dawn::Kb::CVE_2013_1655.new,
           Dawn::Kb::CVE_2013_1656.new,

data/lib/dawn/version.rb

@@ -1,7 +1,7 @@
 module Dawn
-    VERSION = "1.6.2"
+    VERSION = "1.6.3"
     CODENAME = "Tow Mater"
-    RELEASE = "20160301"
-    BUILD = "9"
-    COMMIT = "gc67c5bf"
+    RELEASE = "20160906"
+    BUILD = "15"
+    COMMIT = "g16d339b"
 end

data/spec/lib/dawn/codesake_knowledgebase_spec.rb

@@ -30,13 +30,18 @@ describe "The Codesake Dawn knowledge base" do
     expect(sc.class).to eq(Dawn::Kb::CVE_2013_1855)
   end 
 
-
   it "must have test for CVE_2013_0333" do 
     sc = kb.find("CVE-2013-0333")
     expect(sc).not_to   be_nil
     expect(sc.class).to eq(Dawn::Kb::CVE_2013_0333)
   end
 
+  it "must have test for CVE_2013_0334" do 
+    sc = kb.find("CVE-2013-0334")
+    expect(sc).not_to   be_nil
+    expect(sc.class).to eq(Dawn::Kb::CVE_2013_0334)
+  end
+
   it "must have test for CVE_2013_1857" do
     sc = kb.find("CVE-2013-1857")
     expect(sc).not_to   be_nil

data/spec/lib/kb/cve_2013_0334_spec.rb

@@ -0,0 +1,35 @@
+require 'spec_helper'
+describe "The CVE-2013-0334 vulnerability" do
+	before(:all) do
+		@check = Dawn::Kb::CVE_2013_0334.new
+		# @check.debug = true
+	end
+  it "is not reported when bundler version 1.7.0 is used" do
+    @check.dependencies = [{:name=>"bundler", :version=>'1.7.0'}]
+    expect(@check.vuln?).to eq(false)
+  end
+  it "is not reported when bundler version 1.7.1 is used" do
+    @check.dependencies = [{:name=>"bundler", :version=>'1.7.1'}]
+    expect(@check.vuln?).to eq(false)
+  end
+  it "is not reported when bundler version 1.8.7 is used" do
+    @check.dependencies = [{:name=>"bundler", :version=>'1.8.7'}]
+    expect(@check.vuln?).to eq(false)
+  end
+  it "is not reported when bundler version 1.10.0.rc is used" do
+    @check.dependencies = [{:name=>"bundler", :version=>'1.10.0.rc'}]
+    expect(@check.vuln?).to eq(false)
+  end
+  it "is not reported when bundler version 1.12.5 is used" do
+    @check.dependencies = [{:name=>"bundler", :version=>'1.12.5'}]
+    expect(@check.vuln?).to eq(false)
+  end
+  it "fires when vulnerable bundler version it has been found (1.6.6)" do
+    @check.dependencies = [{:name=>"bundler", :version=>'1.6.6'}]
+    expect(@check.vuln?).to   eq(true)
+  end
+  it "fires when vulnerable bundler version it has been found (1.3.0)" do
+    @check.dependencies = [{:name=>"bundler", :version=>'1.3.0'}]
+    expect(@check.vuln?).to   eq(true)
+  end
+end

data/spec/lib/kb/cve_2015_7577_spec.rb

@@ -17,6 +17,10 @@ describe "The CVE-2015-7577 vulnerability" do
 		expect(@check.vuln?).to   eq(true)
 	end
 	it "is reported when the vulnerable gem is detected" do
+    @check.dependencies = [{:name=>"activerecord", :version=>"3.1.2"}]
+		expect(@check.vuln?).to   eq(true)
+	end
+	it "is reported when the vulnerable gem is detected" do
     @check.dependencies = [{:name=>"activerecord", :version=>"3.2.22"}]
 		expect(@check.vuln?).to   eq(true)
 	end
@@ -25,6 +29,10 @@ describe "The CVE-2015-7577 vulnerability" do
 		expect(@check.vuln?).to   eq(false)
 	end
 	it "is not reported when a fixed release is detected" do
+    @check.dependencies = [{:name=>"activerecord", :version=>"5.0.0.1"}]
+		expect(@check.vuln?).to   eq(false)
+	end
+	it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"activerecord", :version=>"4.2.5.1"}]
 		expect(@check.vuln?).to   eq(false)
 	end
@@ -41,6 +49,10 @@ describe "The CVE-2015-7577 vulnerability" do
 		expect(@check.vuln?).to   eq(false)
 	end
 	it "is not reported when a fixed release is detected" do
+    @check.dependencies = [{:name=>"activerecord", :version=>"3.0.1"}]
+		expect(@check.vuln?).to   eq(false)
+	end
+	it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"activerecord", :version=>"3.2.22.1"}]
 		expect(@check.vuln?).to   eq(false)
 	end

data/spec/lib/kb/cve_2016_0751_spec.rb

@@ -17,6 +17,10 @@ it "is reported when the vulnerable gem is detected" do
 		expect(@check.vuln?).to   eq(true)
 	end
 	it "is reported when the vulnerable gem is detected" do
+    @check.dependencies = [{:name=>"actionpack", :version=>"4.0.3"}]
+		expect(@check.vuln?).to   eq(true)
+	end
+	it "is reported when the vulnerable gem is detected" do
     @check.dependencies = [{:name=>"actionpack", :version=>"3.2.22"}]
 		expect(@check.vuln?).to   eq(true)
 	end

data/spec/lib/kb/cve_2016_2098_spec.rb

@@ -25,6 +25,14 @@ describe "The CVE-2016-2098 vulnerability" do
 		expect(@check.vuln?).to   eq(false)
 	end
 	it "is not reported when a fixed release is detected" do
+    @check.dependencies = [{:name=>"actionpack", :version=>"5.0.0"}]
+		expect(@check.vuln?).to   eq(false)
+	end
+	it "is not reported when a fixed release is detected" do
+    @check.dependencies = [{:name=>"actionpack", :version=>"5.0.0.1"}]
+		expect(@check.vuln?).to   eq(false)
+	end
+	it "is not reported when a fixed release is detected" do
     @check.dependencies = [{:name=>"actionpack", :version=>"3.2.22.2"}]
 		expect(@check.vuln?).to   eq(false)
 	end
@@ -36,4 +44,12 @@ describe "The CVE-2016-2098 vulnerability" do
     @check.dependencies = [{:name=>"actionpack", :version=>"4.2.5.2"}]
 		expect(@check.vuln?).to   eq(false)
 	end
+	it "is not reported when a fixed release is detected" do
+    @check.dependencies = [{:name=>"actionpack", :version=>"4.2.6"}]
+		expect(@check.vuln?).to   eq(false)
+	end
+	it "is not reported when a fixed release is detected" do
+    @check.dependencies = [{:name=>"actionpack", :version=>"4.1.15"}]
+		expect(@check.vuln?).to   eq(false)
+	end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dawnscanner
 version: !ruby/object:Gem::Version
-  version: 1.6.2
+  version: 1.6.3
 platform: ruby
 authors:
 - Paolo Perego
@@ -30,7 +30,7 @@ cert_chain:
   jm6Bw8fGx65GCWIdgMhH/P0icixcnyrnotnnOrEcmPudIlgEN9qaUYcguOfFBhTH
   1sGpM7KzrYHU8qJJPrdaX0ezIDL4cN/kA/DxYTfUiMw=
   -----END CERTIFICATE-----
-date: 2016-03-01 00:00:00.000000000 Z
+date: 2016-09-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: cvss
@@ -316,6 +316,7 @@ files:
 - checksum/dawnscanner-1.5.2.gem.sha1
 - checksum/dawnscanner-1.6.0.gem.sha1
 - checksum/dawnscanner-1.6.1.gem.sha1
+- checksum/dawnscanner-1.6.2.gem.sha1
 - dawnscanner.gemspec
 - doc/dawn_1_0_announcement.md
 - doc/dawn_1_1_announcement.md
@@ -435,6 +436,7 @@ files:
 - lib/dawn/kb/cve_2013_0284.rb
 - lib/dawn/kb/cve_2013_0285.rb
 - lib/dawn/kb/cve_2013_0333.rb
+- lib/dawn/kb/cve_2013_0334.rb
 - lib/dawn/kb/cve_2013_1607.rb
 - lib/dawn/kb/cve_2013_1655.rb
 - lib/dawn/kb/cve_2013_1656.rb
@@ -612,6 +614,7 @@ files:
 - spec/lib/kb/cve_2013_0256_spec.rb
 - spec/lib/kb/cve_2013_0262_spec.rb
 - spec/lib/kb/cve_2013_0263_spec.rb
+- spec/lib/kb/cve_2013_0334_spec.rb
 - spec/lib/kb/cve_2013_1607_spec.rb
 - spec/lib/kb/cve_2013_1655_spec.rb
 - spec/lib/kb/cve_2013_1756_spec.rb
@@ -756,6 +759,7 @@ test_files:
 - spec/lib/kb/cve_2013_0256_spec.rb
 - spec/lib/kb/cve_2013_0262_spec.rb
 - spec/lib/kb/cve_2013_0263_spec.rb
+- spec/lib/kb/cve_2013_0334_spec.rb
 - spec/lib/kb/cve_2013_1607_spec.rb
 - spec/lib/kb/cve_2013_1655_spec.rb
 - spec/lib/kb/cve_2013_1756_spec.rb