dawnscanner 1.6.9 → 2.0.0.rc1

data/lib/dawn/kb/cve_2004_0755.rb

@@ -1,33 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-06
-			class CVE_2004_0755
-				include RubyVersionCheck
-
-				def initialize
-          message = "The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions."
-
-          super({
-            :name=>"CVE-2004-0755",
-            :cvss=>"AV:L/AC:L/Au:N/C:P/I:N/A:N",
-            :release_date => Date.new(2004, 10, 20),
-            :cve=>"2004-0755",
-            :severity=>:medium,
-            :priority=>:medium,
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://xforce.iss.net/xforce/xfdb/16996"]
-          })
-
-          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.999", :patchlevel=>"p0"}, {:engine=>"ruby", :version=>"1.6.999", :patchlevel=>"p0"}]
-
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2004_0983.rb

@@ -1,31 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-06
-			class CVE_2004_0983
-				include RubyVersionCheck
-
-				def initialize
-          message = "The CGI module in Ruby 1.6 before 1.6.8, and 1.8 before 1.8.2, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a certain HTTP request." 
-          super({
-            :name=>"CVE-2004-0983",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2005, 03, 01),
-            :cve=>"2004-0983",
-            :severity=>:high,
-            :priority=>:high,
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://xforce.iss.net/xforce/xfdb/17985"]
-          })
-
-          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p0"}, {:engine=>"ruby", :version=>"1.6.7", :patchlevel=>"p0"}]
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2005_1992.rb

@@ -1,31 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-06
-			class CVE_2005_1992
-				include RubyVersionCheck
-
-				def initialize
-          message = "The XMLRPC server in utils.rb for the ruby library (libruby) 1.8 sets an invalid default value that prevents \"security protection\" using handlers, which allows remote attackers to execute arbitrary commands."
-
-          super({
-            :name=>"CVE-2005-1992",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2005, 06, 20),
-            :cve=>"CVE-2005-1992",
-            :priority=>:high,
-            :severity=>:high,
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://www2.ruby-lang.org/en/20050701.html"]
-          })
-
-          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.999", :patchlevel=>"p0"}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2005_2337.rb

@@ -1,33 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-06
-			class CVE_2005_2337
-				include RubyVersionCheck
-
-				def initialize
-          message="Ruby 1.6.x up to 1.6.8, 1.8.x up to 1.8.2, and 1.9.0 development up to 2005-09-01 allows attackers to bypass safe level and taint flag protections and execute disallowed code when Ruby processes a program through standard input (stdin)."
-          super({
-            :name=>"CVE-2005-2337",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2005, 10, 07),
-            :cve=>"CVE-2005-2337",
-            :severity=>:high,
-            :priority=>:high,
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://www.ruby-lang.org/en/20051003.html"]
-          })
-
-          self.safe_rubies = [
-            {:engine=>"ruby", :version=>"1.6.8", :patchlevel=>"p0"}, 
-            {:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p0"}, 
-          ]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2006_1931.rb

@@ -1,30 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-06
-			class CVE_2006_1931
-				include RubyVersionCheck
-
-				def initialize
-          message = "The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers to cause a denial of service (blocked connections) via a large amount of data."
-          super({
-            :name=>"CVE-2006-1931",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2005, 06, 20),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://www.securityfocus.com/bid/17645"]
-          })
-
-          self.safe_rubies = [
-            {:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p0"},
-            {:engine=>"ruby", :version=>"1.6.8", :patchlevel=>"p0"}
-          ]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2006_2582.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-07
-			class CVE_2006_2582
-				include DependencyCheck
-
-				def initialize
-          message = "The editing form in RWiki 2.1.0pre1 through 2.1.0 allows remote attackers to execute arbitrary Ruby code via unknown attack vectors."
-          super({
-            :name=>"CVE-2006-2582",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2006, 5, 25),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rwiki to version 2.1.0 or above",
-            :aux_links=>["http://secunia.com/advisories/20264"]
-          })
-
-          self.safe_dependencies = [{:name=>"rwiki", :version=>['2.1.0']}]
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2006_3694.rb

@@ -1,31 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-07
-			class CVE_2006_3694
-				include RubyVersionCheck
-
-				def initialize
-          message = "Multiple unspecified vulnerabilities in Ruby before 1.8.5 allow remote attackers to bypass \"safe level\" checks via unspecified vectors involving (1) the alias function and (2) \"directory operations\"."
-         super({
-            :name=>"CVE-2006-3694",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:N",
-            :release_date => Date.new(2006, 7, 21),
-            :cwe=>"",
-            :severity=>:medium,
-            :priority=>:medium,
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://www.securityfocus.com/bid/18944"]
-          })
-
-          self.safe_rubies = [
-            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p0"}
-          ]
- 
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2006_4112.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-07
-			class CVE_2006_4112
-				include DependencyCheck
-
-				def initialize
-          message = "Unspecified vulnerability in the \"dependency resolution mechanism\" in Ruby on Rails 1.1.0 through 1.1.5 allows remote attackers to execute arbitrary Ruby code via a URL that is not properly handled in the routing code, which leads to a denial of service (application hang) or \"data loss,\" a different vulnerability than CVE-2006-4111."
-           super({
-            :name=>"CVE-2006-4112",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2006, 8, 14),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 1.1.6 or higher. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['1.1.6']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2006_5467.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-07
-			class CVE_2006_5467
-				include RubyVersionCheck
-
-				def initialize
-          message = "The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via an HTTP request with a multipart MIME body that contains an invalid boundary specifier, as demonstrated using a specifier that begins with a \"-\" instead of \"--\" and contains an inconsistent ID."
-
-           super({
-            :name=>"CVE-2006-5467",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2006, 10, 27),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://www.securityfocus.com/bid/20777"]
-          })
-
-          self.safe_rubies = [{:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p0"}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2006_6303.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-07
-			class CVE_2006_6303
-				include RubyVersionCheck
-
-				def initialize
-          message = "The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect boundaries in MIME multipart content, which allows remote attackers to cause a denial of service (infinite loop) via crafted HTTP requests, a different issue than CVE-2006-5467."
-
-          super({
-            :name=>"CVE-2006-6303",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2006, 12, 6),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/"]
-          })
-
-          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p0"}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2006_6852.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-07
-			class CVE_2006_6852
-				include DependencyCheck
-
-				def initialize
-          message = "Eval injection vulnerability in tDiary 2.0.3 and 2.1.4.20061127 allows remote authenticated users to execute arbitrary Ruby code via unspecified vectors, possibly related to incorrect input validation by (1) conf.rhtml and (2) i.conf.rhtml. NOTE: some of these details are obtained from third party information."
-          super({
-            :name=>"CVE-2006-6852",
-            :cvss=>"AV:N/AC:M/Au:S/C:P/I:P/A:P",
-            :release_date => Date.new(2006, 12, 31),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade tdiary version to the latest version.",
-            :aux_links=>["http://www.tdiary.org/20061210.html"]
-          })
-
-          self.safe_dependencies = [{:name=>"tdiary", :version=>['2.0.4', '2.1.5']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2006_6979.rb

@@ -1,29 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-07
-			class CVE_2006_6979
-				include DependencyCheck
-
-				def initialize
-          message = "The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters."
-
-          super({
-            :name=>"CVE-2006-6979",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2007, 2, 8),
-            :cwe=>"20",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"It seems there is no real workaround but not using amarok in your project. If it's needed, please sanitize your code before passing input to Magnatune component",
-            :aux_links=>["http://www.securityfocus.com/bid/22568"]
-          })
-
-          self.safe_dependencies = [{:name=>"amarok", :version=>['999.999.999']}]
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2007_0469.rb

@@ -1,29 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-07
-			class CVE_2007_0469
-				include DependencyCheck
-
-				def initialize
-          message = "The extract_files function in installer.rb in RubyGems before 0.9.1 does not check whether files exist before overwriting them, which allows user-assisted remote attackers to overwrite arbitrary files, cause a denial of service, or execute arbitrary code via crafted GEM packages."
-           super({
-            :name=>"CVE-2007-0469",
-            :cvss=>"AV:N/AC:M/Au:N/C:C/I:C/A:C",
-            :release_date => Date.new(2007, 1, 24),
-            :cwe=>"",
-            :severity=>:high,
-            :priority=>:high,
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"This vulnerability should never occur due to the rubygem evolution. However if it has been found, please upgrade your whole development environment ot something newer",
-            :aux_links=>["http://www.securityfocus.com/archive/1/archive/1/458128/100/0/threaded"]
-          })
-
-          self.safe_dependencies = [{:name=>"rubygems", :version=>['0.9.1', '0.8.12']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2007_5162.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-09
-			class CVE_2007_5162
-				include RubyVersionCheck
-
-				def initialize
-          message = "The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site."
-
-          super({
-            :name=>"CVE-2007-5162",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2007, 10, 1),
-            :cwe=>"287",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13504"]
-          })
-
-          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p999"}, {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p999"}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2007_5379.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-09
-			class CVE_2007_5379
-				include DependencyCheck
-
-				def initialize
-          message = "Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file."
-          super({
-            :name=>"CVE-2007-5379",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",
-            :release_date => Date.new(2007, 10, 19),
-            :cwe=>"200",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 1.2.4 or higher. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['1.2.4']}]
-
-				end
-			end
-		end
-	end