dawnscanner 1.6.9 → 2.0.0.rc1

data/lib/dawn/kb/cve_2015_1819.rb

@@ -1,34 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-12-03
-			class CVE_2015_1819
-				# Include the testing skeleton for this CVE
-				# include PatternMatchCheck
-				include DependencyCheck
-				# include RubyVersionCheck
-
-				def initialize
-          title="Nokogiri denial of service (DoS) Memory Consumption"
-          message="Nokogiri versions before 1.6.6.4 contain a vulnerable version of libxml2 as a C extension. The vulnerability allows for memory consumption denial of service."
-          super({
-            :title=>title,
-            :name=> "CVE-2015-1819",
-            :cve=>"2015-1819",
-            :osvdb=>"",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2015, 8, 14),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade nokogiri gem to version 1.6.6.4 or later.",
-            :aux_links=>[""]
-           })
-          self.safe_dependencies = [{:name=>"nokogiri", :version=>['1.6.6.4']}]
-
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_1840/cve_2015_1840_a.rb

@@ -1,28 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-07-29
-			class CVE_2015_1840_a
-				include DependencyCheck
-
-				def initialize
-          message = "jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value."
-
-          super({
-            :name=>"CVE-2015-1840",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",
-            :release_date => Date.new(2015, 7, 26),
-            :cwe=>"200",
-            :owasp=>"A8",
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade jquery-ujs and jquery-rails gems to latest version.",
-            :aux_links=>["https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md", "https://github.com/rails/jquery-ujs/blob/master/CHANGELOG.md"]
-           })
-          self.save_major = true
-          self.safe_dependencies = [{:name=>"jquery-rails", :version=>['4.0.2', '3.1.3']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_1840/cve_2015_1840_b.rb

@@ -1,28 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-07-29
-			class CVE_2015_1840_b
-				include DependencyCheck
-
-				def initialize
-          message = "jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space character in a URL within an attribute value."
-
-          super({
-            :name=>"CVE-2015-1840",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",
-            :release_date => Date.new(2015, 7, 26),
-            :cwe=>"200",
-            :owasp=>"A8",
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade jquery-ujs and jquery-rails gems to latest version.",
-            :aux_links=>["https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md", "https://github.com/rails/jquery-ujs/blob/master/CHANGELOG.md"]
-           })
-
-          self.safe_dependencies = [{:name=>"jquery-ujs", :version=>['1.0.4']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_2963.rb

@@ -1,27 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-07-29
-			class CVE_2015_2963
-				include DependencyCheck
-
-				def initialize
-          message = "The thoughtbot paperclip gem before 4.2.2 for Ruby does not consider the content-type value during media-type validation, which allows remote attackers to upload HTML documents and conduct cross-site scripting (XSS) attacks via a spoofed value, as demonstrated by image/jpeg."
-          super({
-            :name=>"CVE-2015-2963",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2015, 7, 10),
-            :cwe=>"79",
-            :owasp=>"A1",
-            :applies=>["sinatra", "padrino", "rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade paperclip gem to latest version.",
-            :aux_links=>["https://github.com/thoughtbot/paperclip/commit/9aee4112f36058cd28d5fe4a006d6981bd1eda57","https://robots.thoughtbot.com/paperclip-security-release"]
-           })
-
-          self.safe_dependencies = [{:name=>"paperclip", :version=>['4.2.2']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_3224.rb

@@ -1,26 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-07-29
-			class CVE_2015_3224
-				include DependencyCheck
-
-				def initialize
-          message = "request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request."
-           super({
-            :name=>"CVE-2015-3224",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2015, 7, 26),
-            :cwe=>"284",
-            :owasp=>"A9",
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade web-console gem to latest version.",
-            :aux_links=>["https://groups.google.com/forum/message/raw?msg=rubyonrails-security/lzmz9_ijUFw/HBMPi4zp5NAJ"]
-           })
-
-           self.safe_dependencies = [{:name=>"web-console", :version=>['2.1.3']}]
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_3225.rb

@@ -1,28 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-07-29
-			class CVE_2015_3225
-				include DependencyCheck
-
-				def initialize
-          message = "lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth."
-
-          super({
-            :name=>"CVE-2015-3225",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2015, 7, 26),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["sinatra", "padrino", "rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rack gem to latest version or at least 1.5.4 or 1.6.2.",
-            :aux_links=>["https://groups.google.com/forum/message/raw?msg=rubyonrails-security/gcUbICUmKMc/qiCotVZwXrMJ"]
-           })
-          self.save_minor = true
-          self.safe_dependencies = [{:name=>"rack", :version=>['1.5.4', '1.6.2']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_3226.rb

@@ -1,27 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-07-29
-			class CVE_2015_3226
-				include DependencyCheck
-
-				def initialize
-          message = "Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding."
-          super({
-            :name=>"CVE-2015-3226",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2015, 7, 26),
-            :cwe=>"79",
-            :owasp=>"A3",
-            :applies=>["sinatra", "padrino", "rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade activesupport gem to latest version or at least 4.1.12 or 4.2.3. This is automatically done by upgrading your Rails environment if you are using it.",
-            :aux_links=>["https://groups.google.com/forum/message/raw?msg=rubyonrails-security/7VlB_pck3hU/3QZrGIaQW6cJ"]
-           })
-          self.save_minor = true
-          self.safe_dependencies = [{:name=>"activesupport", :version=>['4.1.12', '4.2.3', '3.99.99']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_3227.rb

@@ -1,28 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-07-29
-			class CVE_2015_3227
-				include DependencyCheck
-
-				def initialize
-          message = "The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth."
-
-          super({
-            :name=>"CVE-2015-3227",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2015, 7, 26),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["sinatra", "padrino", "rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade activesupport gem to latest version or at least 4.1.12 or 4.2.3. This is automatically done by upgrading your Rails environment if you are using it.",
-            :aux_links=>["https://groups.google.com/forum/message/raw?msg=rubyonrails-security/bahr2JLnxvk/x4EocXnHPp8J"]
-           })
-          self.save_minor = true
-          self.safe_dependencies = [{:name=>"activesupport", :version=>['4.1.12', '4.2.3']}]
-          self.save_major = true
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_3448.rb

@@ -1,29 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-07-30
-			class CVE_2015_3448
-				include DependencyCheck
-
-				def initialize
-          message = "REST client for Ruby (aka rest-client) before 1.7.3 logs usernames and passwords, which allows local users to obtain sensitive information by reading the log."
-
-          super({
-            :name=>"CVE-2015-3448",
-            :cvss=>"AV:L/AC:L/Au:N/C:P/I:N/A:N",
-            :release_date => Date.new(2015, 4, 29),
-            :cwe=>"200",
-            :owasp=>"A9",
-            :osvdb=>"117461",
-            :applies=>["sinatra", "padrino", "rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rest-client gem to the latest version",
-            :aux_links=>["https://github.com/rest-client/rest-client/issues/349","http://www.osvdb.org/117461"]
-           })
-
-          self.safe_dependencies = [{:name=>"rest-client", :version=>['1.7.3']}]
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_4020.rb

@@ -1,34 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2015-12-02
-			class CVE_2015_4020
-				# Include the testing skeleton for this CVE
-				# include PatternMatchCheck
-				# include DependencyCheck
-				# include RubyVersionCheck
-        include GemCheck
-
-				def initialize
-          title="RubyGems remote_fetcher.rb api_endpoint() Function Missing SRV Record Hostname Validation Request Hijacking"
-          message = "RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API request, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a 'DNS hijack attack.'"
-          super({
-            :title=>title,
-            :name=> "CVE-2015-4020",
-            :cve=>"2015-4020",
-            :osvdb=>"122162",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2015, 8, 25),
-            :cwe=>"",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::GEM_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rubygem to version 3.2.3 or later.",
-            :aux_links=>[""]
-           })
-
-          self.safe_versions = [{:version=>['2.0.17', '2.2.5', '2.4.8']}]
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_5312.rb

@@ -1,30 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-01
-			class CVE_2015_5312
-				include DependencyCheck
-
-				def initialize
-          message = "The xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.3 does not properly prevent entity expansion, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted XML data, a different vulnerability than CVE-2014-3660."
-           super({
-            :title=>title,
-            :name=> "CVE-2015-5312",
-            :cve=>"2015-5312",
-            :osvdb=>"",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:N/A:C",
-            :release_date => Date.new(2015, 12, 15),
-            :cwe=>"119",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade nokogiri gem to version 1.6.7.1 or later.",
-            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s"]
-           })
-
-           self.safe_dependencies = [{:name=>"nokogiri", :version=>['1.6.7.1']}]
-           self.not_affected = {:name=>"nokogiri", :version=>['1.5.x', '1.4.x', '1.3.x', '1.1.x', '1.0.x', '0.x.x']}
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_7497.rb

@@ -1,32 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-02
-			class CVE_2015_7497
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message ="Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors."
-          super({
-            :title=>title,
-            :name=> "CVE-2015-7497",
-            :cve=>"2015-7497",
-            :osvdb=>"",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2015, 12, 15),
-            :cwe=>"119",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade nokogiri gem to version 1.6.7.1 or later.",
-            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s"]
-           })
-
-           self.safe_dependencies = [{:name=>"nokogiri", :version=>['1.6.7.1']}]
-           self.not_affected = {:name=>"nokogiri", :version=>['1.5.x', '1.4.x', '1.3.x', '1.1.x', '1.0.x', '0.x.x']}
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_7498.rb

@@ -1,32 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-02
-			class CVE_2015_7498
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message = "Heap-based buffer overflow in the xmlParseXmlDecl function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service via unspecified vectors related to extracting errors after an encoding conversion failure."
-           super({
-            :title=>title,
-            :name=> "CVE-2015-7498",
-            :cve=>"2015-7498",
-            :osvdb=>"",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2015, 12, 15),
-            :cwe=>"119",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade nokogiri gem to version 1.6.7.1 or later.",
-            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s"]
-           })
-
-           self.safe_dependencies = [{:name=>"nokogiri", :version=>['1.6.7.1']}]
-           self.not_affected = {:name=>"nokogiri", :version=>['1.5.x', '1.4.x', '1.3.x', '1.1.x', '1.0.x', '0.x.x']}
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_7499.rb

@@ -1,32 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-02
-			class CVE_2015_7499
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message="Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors."
-           super({
-            :title=>title,
-            :name=> "CVE-2015-7499",
-            :cve=>"2015-7499",
-            :osvdb=>"",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",
-            :release_date => Date.new(2015, 12, 15),
-            :cwe=>"119",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade nokogiri gem to version 1.6.7.1 or later.",
-            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s"]
-           })
-
-           self.safe_dependencies = [{:name=>"nokogiri", :version=>['1.6.7.1']}]
-           self.not_affected = {:name=>"nokogiri", :version=>['1.5.x', '1.4.x', '1.3.x', '1.1.x', '1.0.x', '0.x.x']}
-
-				end
-			end
-		end
-end

data/lib/dawn/kb/cve_2015_7500.rb

@@ -1,32 +0,0 @@
-module Dawn
-		module Kb
-			# Automatically created with rake on 2016-02-02
-			class CVE_2015_7500
-				# Include the testing skeleton for this CVE
-				include DependencyCheck
-
-				def initialize
-          message = "The xmlParseMisc function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of service (out-of-bounds heap read) via unspecified vectors related to incorrect entities boundaries and start tags."
-           super({
-            :title=>title,
-            :name=> "CVE-2015-7500",
-            :cve=>"2015-7500",
-            :osvdb=>"",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2015, 12, 15),
-            :cwe=>"119",
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade nokogiri gem to version 1.6.7.1 or later.",
-            :aux_links=>["https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s"]
-           })
-
-           self.safe_dependencies = [{:name=>"nokogiri", :version=>['1.6.7.1']}]
-           self.not_affected = {:name=>"nokogiri", :version=>['1.5.x', '1.4.x', '1.3.x', '1.1.x', '1.0.x', '0.x.x']}
-
-				end
-			end
-		end
-end