dawnscanner 1.6.8 → 2.0.0.rc4

data/lib/dawn/kb/cve_2013_6414.rb

@@ -1,30 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-12-12
-			class CVE_2013_6414
-				include DependencyCheck
-
-				def initialize
-          message = "actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching."
-
-
-          super({
-            :name=>"CVE-2013-6414",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2013, 12, 7),
-            :cwe=>"20",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails to version 3.2.16 or 4.0.2. As a general rule, using the latest stable version is recommended.",
-            :aux_links=>["https://groups.google.com/forum/message/raw?msg=ruby-security-ann/A-ebV4WxzKg/KNPTbX8XAQUJ"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['3.2.16', '4.0.2', '3.1.9999', '3.0.9999']}]
-          self.save_major = true
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_6415.rb

@@ -1,29 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-12-12
-			class CVE_2013_6415
-				include DependencyCheck
-
-				def initialize
-          message="Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter."
-          super({
-            :name=>"CVE-2013-6415",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2013, 12, 7),
-            :cwe=>"79",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails to version 3.2.16 or 4.0.2. As a general rule, using the latest stable version is recommended.",
-            :aux_links=>["https://groups.google.com/forum/message/raw?msg=ruby-security-ann/9WiRn2nhfq0/2K2KRB4LwCMJ"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['3.2.16', '4.0.2', '3.1.9999', '3.0.9999']}]
-          self.save_major = true
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_6416.rb

@@ -1,29 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-12-12
-			class CVE_2013_6416
-				include DependencyCheck
-
-				def initialize
-          message = "Cross-site scripting (XSS) vulnerability in the simple_format helper in actionpack/lib/action_view/helpers/text_helper.rb in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute."
-
-          super({
-            :name=>"CVE-2013-6416",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2013, 12, 7),
-            :cwe=>"79",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails to version 4.0.2. As a general rule, using the latest stable version is recommended. Versions 3.x are not affected",
-            :aux_links=>["https://groups.google.com/forum/message/raw?msg=ruby-security-ann/5ZI1-H5OoIM/ZNq4FoR2GnIJ"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['4.0.2']}]
-          self.save_major = true
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_6417.rb

@@ -1,30 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-12-12
-			class CVE_2013_6417
-				include DependencyCheck
-
-				def initialize
-          message ="actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155."
-
-           super({
-            :name=>"CVE-2013-6417",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:N",
-            :release_date => Date.new(2013, 12, 7),
-            :cwe=>"264",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails to version 3.2.16 or 4.0.2. As a general rule, using the latest stable version is recommended.",
-            :aux_links=>["https://groups.google.com/forum/message/raw?msg=ruby-security-ann/niK4drpSHT4/g8JW8ZsayRkJ"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['3.2.16', '4.0.2', '3.1.9999', '3.0.9999']}]
-
-          self.save_major = true
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_6421.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-12-17
-			class CVE_2013_6421
-				include DependencyCheck
-
-				def initialize
-          message = "The unpack_zip function in archive_unpacker.rb in the sprout gem 0.7.246 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a (1) filename or (2) path."
-
-           super({
-            :name=>'CVE-2013-6421', 
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",  
-            :release_date => Date.new(2013, 12, 12),
-            :cwe=>"94", 
-            :owasp=>"A9",
-            :applies=>["rails", "padrino", "sinatra"],
-            :kind => Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message => message,
-            :mitigation=>"Please upgrade sprout rubygem",
-            :aux_links => ["http://www.openwall.com/lists/oss-security/2013/12/03/1"]
-          })
-          self.safe_dependencies = [{:name=>"sprout", :version=>['0.7.247']}]
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_6459.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-14
-			class CVE_2013_6459
-				include DependencyCheck
-
-				def initialize
-          message = "Cross-site scripting (XSS) vulnerability in the will_paginate gem before 3.0.5 for Ruby allows remote attackers to inject arbitrary web script or HTML via vectors involving generated pagination links."
-          
-          super({
-            :name=>"CVE-2013-6459",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2013, 12, 31),
-            :cwe=>"79",
-            :owasp=>"A3", 
-            :applies=>["sinatra", "padrino", "rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade will_paginage version to 3.0.5. As a general rule, using the latest stable version is recommended.",
-            :aux_links=>["https://github.com/mislav/will_paginate/releases/tag/v3.0.5"]
-          })
-
-          self.safe_dependencies = [{:name=>"will_paginate", :version=>['3.0.5']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_6460.rb

@@ -1,53 +0,0 @@
-	module Dawn
-		module Kb
-
-      class CVE_2013_6460_a
-        include DependencyCheck
-
-        def initialize
-          message = "Vulnerability arises when Nokogiri version 1.6.0 and 1.5.x (x<11) is used"
-          super({
-            :name=>"CVE_2013_6460_a",
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-          })
-          self.safe_dependencies = [{:name=>"nokogiri", :version=>['1.6.1', '1.5.11']}]
-        end
-
-      end
-
-      class CVE_2013_6460_b
-        include RubyVersionCheck
-        def initialize
-          message = "Vulnerability arises when Nokogiri version 1.6.0 and 1.5.x (x<11) is used with JRuby"
-          super({
-            :name=>"CVE_2013_6460_b",
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-          })
-          self.safe_rubies = [ {:engine=>"jruby", :version=>"99.99.99", :patchlevel=>"p999"}]
-          # self.debug = true
-        end
-      end
-
-			class CVE_2013_6460
-        include ComboCheck
-
-				def initialize
-          message = "There is a vulnerability in Nokogiri when using JRuby where the parser can enter an infinite loop and exhaust the process memory. Nokogiri users on JRuby using the native Java extension.  Attackers can send XML documents with carefully crafted documents which can cause the XML processor to enter an infinite loop, causing the server to run out of memory and crash."
-
-          super({
-            :name=>"CVE-2013-6460",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2013, 12, 15),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::COMBO_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade nokogiri gem to a newer version",
-            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA", "https://access.redhat.com/security/cve/CVE-2013-6460"],
-            :checks=>[CVE_2013_6460_a.new, CVE_2013_6460_b.new]
-          })
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_6461.rb

@@ -1,57 +0,0 @@
-	module Dawn
-		module Kb
-
-      class CVE_2013_6461_a
-        include DependencyCheck
-
-        def initialize
-          message = "Vulnerability arises when Nokogiri version 1.6.0 and 1.5.x (x<11) is used"
-          super({
-            :name=>"CVE_2013_6461_a",
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-          })
-          self.safe_dependencies = [{:name=>"nokogiri", :version=>['1.6.1', '1.5.11']}]
-        end
-
-      end
-
-      class CVE_2013_6461_b
-        include RubyVersionCheck
-        def initialize
-          message = "Vulnerability arises when Nokogiri version 1.6.0 and 1.5.x (x<11) is used with JRuby"
-          super({
-            :name=>"CVE_2013_6461_b",
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-          })
-          self.safe_rubies = [ {:engine=>"jruby", :version=>"99.99.99", :patchlevel=>"p999"}]
-        end
-      end
-
-			class CVE_2013_6461
-        include ComboCheck
-
-				def initialize
-          message = "There is an entity expansion vulnerability in Nokogiri when using JRuby. Nokogiri users on JRuby using the native Java extension.  Attackers can send
-XML documents with carefully crafted entity expansion strings which can cause the server to run out of memory and crash."
-          super({
-            :name=>"CVE-2013-6461",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2013, 12, 15),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::COMBO_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade nokogiri gem to a newer version",
-            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/DeJpjTAg1FA"],
-            :checks=>[CVE_2013_6461_a.new, CVE_2013_6461_b.new]
-          })
-
-
-
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_7086.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-10
-			class CVE_2013_7086
-				include DependencyCheck
-
-				def initialize
-          message = "The message function in lib/webbynode/notify.rb in the Webbynode gem 1.0.5.3 and earlier for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a growlnotify message."
-          super({
-            :name=>"CVE-2013-7086",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2013, 12, 19),
-            :cwe=>"94",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade webbynode up to version 1.0.5.3",
-            :aux_links=>["http://xforce.iss.net/xforce/xfdb/89705"]
-          })
-
-          self.safe_dependencies = [{:name=>"webbynode", :version=>['1.0.5.4']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2014_0036.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-03-14
-			class CVE_2014_0036
-				include DependencyCheck
-
-				def initialize
-          message = "rbovirt Gem for Ruby contains a flaw related to certificate validation. The issue is due to the program failing to validate SSL certificates. This may allow an attacker with access to network traffic (e.g. MiTM, DNS cache poisoning) to spoof the SSL server via an arbitrary certificate that appears valid. Such an attack would allow for the interception of sensitive traffic, and potentially allow for the injection of content into the SSL stream."
-
-           super({
-            :name=>"CVE-2014-0036",
-            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2014, 3, 5),
-            :cwe=>"20",
-            :owasp=>"A9",
-            :applies=>["sinatra", "padrino", "rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rbovirt version at least to 0.0.24. As a general rule, using the latest version is recommended.",
-            :aux_links=>["http://www.securityfocus.com/bid/66006"]
-           })
-
-           self.safe_dependencies = [{:name=>"rbovirt", :version=>['0.0.24']}]
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2014_0080.rb

@@ -1,29 +0,0 @@
-  module Dawn
-    module Kb
-      # Automatically created with rake on 2014-02-19
-      class CVE_2014_0080
-        # Include the testing skeleton for this CVE
-        include DependencyCheck
-
-        def initialize
-          message = "SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute \"add data\" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns."
-
-           super({
-            :name=>"CVE-2014-0080",
-            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2014, 2, 20),
-            :cwe=>"89",
-            :owasp=>"A1",
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 4.0.3 or 4.1.0.beta2. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["https://groups.google.com/forum/message/raw?msg=rubyonrails-security/Wu96YkTUR6s/pPLBMZrlwvYJ"]
-           })
-           self.safe_dependencies = [{:name=>"rails", :version=>['4.0.3', '4.1.0.beta2']}]
-          self.save_major = true
-
-        end
-      end
-    end
-  end

data/lib/dawn/kb/cve_2014_0081.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-02-21
-			class CVE_2014_0081
-				include DependencyCheck
-
-				def initialize
-          message = "Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper."
-           super({
-            :name=>"CVE-2014-0081",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2014, 2, 20),
-            :cwe=>"79",
-            :owasp=>"A3", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 3.2.17, 4.0.3 or 4.1.0.beta2. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["https://groups.google.com/forum/message/raw?msg=rubyonrails-security/tfp6gZCtzr4/j8LUHmu7fIEJ"]
-           })
-
-           self.safe_dependencies = [{:name=>"rails", :version=>['3.2.17', '4.0.3', '4.1.0.beta2', '3.1.99999', '3.0.99999']}]
-          self.save_major = true
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2014_0082.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-02-21
-			class CVE_2014_0082
-				include DependencyCheck
-
-				def initialize
-          message = "actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers."
-
-           super({
-            :name=>"CVE-2014-0082",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2014, 2, 20),
-            :cwe=>"20",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 3.2.17. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["https://groups.google.com/forum/message/raw?msg=rubyonrails-security/LMxO_3_eCuc/ozGBEhKaJbIJ"]
-           })
-
-           self.safe_dependencies = [{:name=>"rails", :version=>['3.2.17', '3.1.9999', '3.0.99999', '2.99999.99999', '1.99999.99999']}]
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2014_0130.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-05-06
-			class CVE_2014_0130
-				include DependencyCheck
-
-				def initialize
-          message = "The implicit render functionality allows controllers to render a template, even if there is no explicit action with the corresponding name.  This module does not perform adequate input sanitization which could allow an attacker to use a specially crafted request to retrieve arbitrary files from the rails application server."
-          super({
-            :name=>"CVE-2014-0130",
-            :cvss=>"AV:N/AC:M/Au:N/C:P/I:N/A:N",
-            :release_date => Date.new(2014, 5, 6),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version up to version 3.2.18, 4.0.5 or 4.1.1.",
-            :aux_links=>["https://groups.google.com/forum/#!msg/rubyonrails-security/NkKc7vTW70o/NxW_PDBSG3AJ"]
-          })
-          self.safe_dependencies = [{:name=>"rails", :version=>['3.2.18', '4.0.5', '4.1.1']}]
-
-          self.save_major = true
-				end
-			end
-		end
-	end