dawnscanner 1.6.9 → 2.0.0.rc1

data/lib/dawn/kb/cve_2013_1857.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-02
-			class CVE_2013_1857
-				include DependencyCheck
-
-        def initialize
-          message = "The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence."
-
-          super({
-            :name=>'CVE-2013-1857', 
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N", 
-            :release_date => Date.new(2013, 3, 19),
-            :cwe=>"79", 
-            :owasp=>"A3",
-            :applies=>["rails"],
-            :kind => Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message => message,
-            :mitigation=>"Please upgrade rails version at least to 2.3.18, 3.0.8, 3.1.10 and 3.2.11. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links => [ "https://groups.google.com/d/msg/rubyonrails-security/zAAU7vGTPvI/1vZDWXqBuXgJ" ]
-          })
-          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.18', '3.0.8', '3.2.13', '3.1.12']}]
-
-        end
-      end
-    end
-  end

data/lib/dawn/kb/cve_2013_1875.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-17
-			class CVE_2013_1875
-				include DependencyCheck
-
-				def initialize
-          message="command_wrap.rb in the command_wrap Gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL or filename."
-         super({
-            :name=>"CVE-2013-1875",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2013, 3, 20),
-            :cwe=>"94",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade command_wrap gem to a newer version",
-            :aux_links=>["http://seclists.org/fulldisclosure/2013/Mar/175"]
-          })
-
-          self.safe_dependencies = [{:name=>"fastreader", :version=>['1.0.9']}]
- 
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_1898.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-27
-			class CVE_2013_1898
-				include DependencyCheck
-
-				def initialize
-          message = "lib/thumbshooter.rb in the Thumbshooter 0.1.5 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL."
-          super({
-            :name=>"CVE-2013-1898",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2013, 4, 9),
-            :cwe=>"94",
-            :owasp=>"A9", 
-            :applies=>["rails", "padrino", "sinatra"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade Thumbshooter version to the latest version available.",
-            :aux_links=>["http://seclists.org/fulldisclosure/2013/Mar/218"]
-          })
-
-          self.safe_dependencies = [{:name=>"thumbshooter", :version=>['0.1.6']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_1911.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-27
-			class CVE_2013_1911
-				include DependencyCheck
-
-				def initialize
-          message = "lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name."
-          super({
-            :name=>"CVE-2013-1911",
-            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2013, 4, 3),
-            :cwe=>"20",
-            :owasp=>"A9", 
-            :applies=>["rails", "padrino", "sinatra"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade ldoce version to the latest version available.",
-            :aux_links=>["http://archives.neohapsis.com/archives/bugtraq/2013-04/0010.html"]
-          })
-
-          self.safe_dependencies = [{:name=>"ldoce", :version=>['0.0.3']}]
-
-          
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_1933.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-27
-			class CVE_2013_1933
-				include DependencyCheck
-
-				def initialize
-          message = "The extract_from_ocr function in lib/docsplit/text_extractor.rb in the Karteek Docsplit (karteek-docsplit) gem 0.5.4 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a PDF filename."
-          super({
-            :name=>"CVE-2013-1933",
-            :cvss=>"AV:N/AC:M/Au:N/C:C/I:C/A:C",
-            :release_date => Date.new(2013, 4, 25),
-            :cwe=>"78",
-            :owasp=>"A9", 
-            :applies=>["rails", "padrino", "sinatra"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade karteek-docsplit version to the latest version available.",
-            :aux_links=>["http://www.openwall.com/lists/oss-security/2013/04/08/15"]
-          })
-
-          self.safe_dependencies = [{:name=>"karteek-docsplit", :version=>['0.5.5']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_1947.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-27
-			class CVE_2013_1947
-				include DependencyCheck
-
-				def initialize
-          message = "kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument to (1) document.rb, (2) video.rb, or (3) video_image.rb."
-          super({
-            :name=>"CVE-2013-1947",
-            :cvss=>"AV:N/AC:M/Au:N/C:C/I:C/A:C",
-            :release_date => Date.new(2013, 4, 25),
-            :cwe=>"78",
-            :owasp=>"A9", 
-            :applies=>["rails", "padrino", "sinatra"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade kelredd-pruview version to the latest version available.",
-            :aux_links=>["http://www.openwall.com/lists/oss-security/2013/04/10/3"]
-          })
-
-          self.safe_dependencies = [{:name=>"kelredd-pruview", :version=>['0.3.9']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_1948.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-27
-			class CVE_2013_1948
-				include DependencyCheck
-
-				def initialize
-          message = "converter.rb in the md2pdf gem 0.0.1 for Ruby allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename."
-          super({
-            :name=>"CVE-2013-1948",
-            :cvss=>"AV:N/AC:L/Au:N/C:C/I:C/A:C",
-            :release_date => Date.new(2013, 4, 25),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "padrino", "sinatra"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade md2pdf gem version to the latest version available.",
-            :aux_links=>["http://www.securityfocus.com/bid/59061"]
-          })
-
-          self.safe_dependencies = [{:name=>"md2pdf", :version=>['0.0.2']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_2065.rb

@@ -1,29 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-10-22
-			class CVE_2013_2065
-				include RubyVersionCheck
-
-				def initialize
-          message = "Native functions exposed to Ruby with DL or Fiddle do not check the taint values set on the objects passed in. This can result in tainted objects being accepted as input when a SecurityError exception should be raised."
-
-          # TODO: fix links and info
-          super({
-            :name=>"CVE-2013-2065",
-            :cvss=>"",
-            :release_date => Date.new(2013, 5, 14),
-            :cwe=>"264",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade ruby interpreter to 1.9.3-p436 or 2.0.0-p195 or latest version available",
-            :aux_links=>["https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/"]
-          })
-
-          self.safe_rubies = [{:engine=>"ruby", :version=>"1.9.3", :patchlevel=>"p426"}, {:engine=>"ruby", :version=>"2.0.0", :patchlevel=>"p195"}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_2090.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-07
-			class CVE_2013_2090
-				include DependencyCheck
-
-				def initialize
-          message = "Ruby Gem Creme Fraiche version 0.6 suffers from a remote command injection vulnerability due to unsanitized input."
-          super({
-            :name=>"CVE-2013-2090",
-            :cvss=>"",
-            :release_date => Date.new(2013, 5, 14),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade cremefraiche gem version to the latest available.",
-            :aux_links=>["http://packetstormsecurity.com/files/cve/CVE-2013-2090"]
-          })
-
-          self.safe_dependencies = [{:name=>"cremefraiche", :version=>['0.6.2']}]
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_2105.rb

@@ -1,26 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-05-12
-			class CVE_2013_2105
-				include DependencyCheck
-
-				def initialize
-          message = "The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html."
-           super({
-            :name=>"CVE-2013-2105",
-            :cvss=>"AV:L/AC:M/AU:N/C:N/I:P/A:P",
-            :release_date => Date.new(2014, 4, 22),
-            :cwe=>"59",
-            :owasp=>"A9",
-            :applies=>["sinatra", "padrino", "rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade show_in_browser version at least to 0.0.4. As a general rule, using the latest stable version is recommended.",
-            :aux_links=>["http://xforce.iss.net/xforce/xfdb/84378"]
-           })
-           self.safe_dependencies = [{:name=>"show_in_browser", :version=>['0.0.4']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_2119.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-10
-			class CVE_2013_2119
-				include DependencyCheck
-
-				def initialize
-          message = "Phusion Passenger gem before 3.0.21 and 4.0.x before 4.0.5 for Ruby allows local users to cause a denial of service (prevent application start) or gain privileges by pre-creating a temporary \"config\" file in a directory with a predictable name in /tmp/ before it is used by the gem."
-           super({
-            :name=>"CVE-2013-2119",
-            :cvss=>"AV:L/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2014, 1, 3),
-            :cwe=>"16",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade passenger to version 3.0.21, 4.0.5 or above",
-            :aux_links=>["http://blog.phusion.nl/2013/05/29/phusion-passenger-4-0-5-released/", "http://blog.phusion.nl/2013/05/29/phusion-passenger-3-0-21-released/"]
-          })
-
-          self.safe_dependencies = [{:name=>"passenger", :version=>['4.0.5', '3.0.21']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_2512.rb

@@ -1,26 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-02-07
-			class CVE_2013_2512
-				include DependencyCheck
-
-				def initialize
-          message = "ftpd Gem for Ruby contains a flaw that is triggered when handling a specially crafted option or filename that contains a shell character. This may allow a remote attacker to inject arbitrary commands"
-          
-          super({
-            :name=>"CVE-2013-2512",
-            :cvss=>"",
-            :release_date => Date.new(2013, 2, 28),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"To mitigate this vulnerability you must upgrade ftpd gem version to 0.2.2 or higher.",
-            :aux_links=>["http://packetstormsecurity.com/files/120618/Ruby-Gem-ftpd-0.2.1-Remote-Command-Execution.html"]
-          })
-          self.safe_dependencies = [{:name=>"ftpd", :version=>['0.2.2']}]
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_2513.rb

@@ -1,25 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-02-07
-			class CVE_2013_2513
-				include DependencyCheck
-
-				def initialize
-          message = "flash_tool Gem for Ruby contains a flaw that is triggered during the handling of downloaded files that contain shell characters. With a specially crafted file, a context-dependent attacker can execute arbitrary commands."
-          super({
-            :name=>"CVE-2013-2513",
-            :cvss=>"",
-            :release_date => Date.new(2013, 3, 4),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"At the time of writing this, there is no solution to this vulnerability by software upgrade since latest version is still 0.6.0. You may want to sanitize your input before passing to offendend library.",
-            :aux_links=>["http://packetstormsecurity.com/files/120626/Flash-Tool-0.6.0-Remote-Code-Execution.html"]
-          })
-          self.safe_dependencies = [{:name=>"flash_tool", :version=>['0.6.1']}]
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_2516.rb

@@ -1,26 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-02-06
-			class CVE_2013_2516
-				include DependencyCheck
-
-				def initialize
-          message = "fileutils Gem for Ruby contains a flaw in file_utils.rb. The issue is triggered when handling a specially crafted URL containing a command after a delimiter (;). This may allow a remote attacker to potentially execute arbitrary commands."
-          super({
-            :name=>"CVE-2013-2516",
-            :cvss=>"",
-            :release_date => Date.new(2013, 2, 28),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"At the time of writing this, there is no solution to this vulnerability by software upgrade since latest version is still 0.7. You may want to sanitize your input before passing to offendend library.",
-            :aux_links=>["http://packetstormsecurity.com/files/120579/Fileutils-Ruby-Gem-Remote-Command-Execution.html"]
-          })
-          self.safe_dependencies = [{:name=>"fileutils", :version=>['0.8']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_2615.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-17
-			class CVE_2013_2615
-				include DependencyCheck
-
-				def initialize
-          message = "lib/entry_controller.rb in the fastreader Gem 1.0.8 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL."
-          super({
-            :name=>"CVE-2013-2615",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2013, 3, 20),
-            :cwe=>"94",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade fastreader gem to a newer version",
-            :aux_links=>["http://seclists.org/fulldisclosure/2013/Mar/122"]
-          })
-
-          self.safe_dependencies = [{:name=>"fastreader", :version=>['1.0.9']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2013_2616.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-27
-			class CVE_2013_2616
-				include DependencyCheck
-
-				def initialize
-          message = "lib/mini_magick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL."
-          super({
-            :name=>"CVE-2013-2616",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2013, 3, 20),
-            :cwe=>"94",
-            :owasp=>"A9", 
-            :applies=>["rails", "padrino", "sinatra"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade mini_magick gem version to the latest version available.",
-            :aux_links=>["http://seclists.org/fulldisclosure/2013/Mar/123"]
-          })
-
-          self.safe_dependencies = [{:name=>"mini_magick", :version=>['1.3.2']}]
-
-				end
-			end
-		end
-	end