dawnscanner 1.6.9 → 2.0.0.rc1

data/lib/dawn/kb/cve_2008_3790.rb

@@ -1,30 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-09
-			class CVE_2008_3790
-				include RubyVersionCheck
-
-				def initialize
-          message = "The REXML module in Ruby 1.8.6 through 1.8.6-p287, 1.8.7 through 1.8.7-p72, and 1.9 allows context-dependent attackers to cause a denial of service (CPU consumption) via an XML document with recursively nested entities, aka an \"XML entity explosion.\""
-          super({
-            :name=>"CVE-2008-3790",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2008, 8, 27),
-            :cwe=>"20",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://www.ruby-lang.org/en/news/2008/08/23/dos-vulnerability-in-rexml/"]
-          })
-
-          self.safe_rubies = [
-            {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p73"}, 
-            {:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p73"}, 
-            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p1"} 
-          ]
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2008_3905.rb

@@ -1,36 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-09
-			class CVE_2008_3905
-				include RubyVersionCheck
-
-				def initialize
-          message = "resolv.rb in Ruby 1.8.5 and earlier, 1.8.6 before 1.8.6-p287, 1.8.7 before 1.8.7-p72, and 1.9 r18423 and earlier uses sequential transaction IDs and constant source ports for DNS requests, which makes it easier for remote attackers to spoof DNS responses, a different vulnerability than CVE-2008-1447."
-          super({
-            :name=>"CVE-2008-3905",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:P",
-            :release_date => Date.new(2008, 9, 4),
-            :cwe=>"287",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://www.ruby-lang.org/en/news/2008/08/08/multiple-vulnerabilities-in-ruby/"]
-          })
-
-          self.safe_rubies = [
-            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p0"}, 
-            {:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p287"}, 
-            {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p999"}, 
-            {:engine=>"ruby", :version=>"1.8.4", :patchlevel=>"p999"}, 
-            {:engine=>"ruby", :version=>"1.8.3", :patchlevel=>"p999"}, 
-            {:engine=>"ruby", :version=>"1.8.2", :patchlevel=>"p999"}, 
-            {:engine=>"ruby", :version=>"1.8.1", :patchlevel=>"p999"}, 
-            {:engine=>"ruby", :version=>"1.8.0", :patchlevel=>"p999"}, 
-            {:engine=>"ruby", :version=>"1.6.999", :patchlevel=>"p0"}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2008_4094.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-09
-			class CVE_2008_4094
-				include DependencyCheck
-
-				def initialize
-          message = "Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer."
-          super({
-            :name=>"CVE-2008-4094",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2008, 9, 30),
-            :cwe=>"89",
-            :owasp=>"A1", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 2.1.1 or higher. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure"]
-          })
-
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['2.1.1', '2.0.999', '1.9.999', '1.2.999', '1.1.999', '0.999.999']}]
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2008_4310.rb

@@ -1,100 +0,0 @@
-module Dawn
-  module Kb
-    class CVE_2008_4310_a
-      include RubyVersionCheck
-      def initialize
-        message = "CVE_2008_4310_a: ruby 1.8.1 and 1.8.5 have problems"
-        super({
-          :name=>"CVE-2008_4310_a",
-          :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-        })
-        self.safe_rubies = [
-          {:engine=>"ruby", :version=>"1.8.1", :patchlevel=>"p999"}, 
-          {:engine=>"ruby", :version=>"1.8.5", :patchlevel=>"p999"}
-        ]
-      end
-    end
-
-    class CVE_2008_4310_b
-      include OperatingSystemCheck
-
-      def initialize
-
-        message =  "CVE_2008_4310_b: Only on RedHat EL 4 and 5"
-
-        super({
-          :name=>"CVE-2008_4310_b",
-          :kind=>Dawn::KnowledgeBase::OS_CHECK,
-        })
-
-        self.safe_os=[
-          #RHEL 5.10
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-371']},             
-          #RHEL 5.9
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-348']}, 
-          #RHEL 5.8
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-308']},  
-          #RHEL 5.7
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-274']},
-          #RHEL 5.6
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-238']}, 
-          #RHEL 5.5
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-194']}, 
-          #RHEL 5.4            
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-164']}, 
-          #RHEL 5.3 
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-128']},  
-          #RHEL 5.2
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-92']},  
-          #RHEL 5.1
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-53']},   
-          #RHEL 5.0
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.18-8']}, 
-          #RHEL 4.9           
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-100']},
-          #RHEL 4.8
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-89']}, 
-          #RHEL 4.7
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-78']}, 
-          #RHEL 4.6
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-67']},
-          #RHEL 4.5 
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-55']}, 
-          #RHEL 4.4
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-42']}, 
-          #RHEL 4.3
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-34']}, 
-          #RHEL 4.2
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-22']}, 
-          #RHEL 4.1
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-11']}, 
-          #RHEL 4.0
-          {:family=>"linux", :vendor=>"redhat", :version=>['2.6.9-5']}
-        ]
-      end
-    end
-
-    class CVE_2008_4310
-      include ComboCheck
-
-      def initialize
-        message = "httputils.rb in WEBrick in Ruby 1.8.1 and 1.8.5, as used in Red Hat Enterprise Linux 4 and 5, allows remote attackers to cause a denial of service (CPU consumption) via a crafted HTTP request. NOTE: this issue exists because of an incomplete fix for CVE-2008-3656."
-
-        super({
-          :name=>"CVE-2008-4310",
-          :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:C",
-          :release_date => Date.new(2008, 12, 9),
-          :cwe=>"399",
-          :owasp=>"A9", 
-          :applies=>["sinatra", "padrino", "rails"],
-          :kind=>Dawn::KnowledgeBase::COMBO_CHECK,
-          :message=>message,
-          :mitigation=>"Please upgrade your ruby interpreter",
-          :aux_links=>["http://secunia.com/advisories/33013"],
-          :checks=>[CVE_2008_4310_a.new, CVE_2008_4310_b.new]
-        })
-
-      end
-    end
-  end
-end

data/lib/dawn/kb/cve_2008_5189.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-09
-			class CVE_2008_5189
-				include DependencyCheck
-
-				def initialize
-          message = "CRLF injection vulnerability in Ruby on Rails before 2.0.5 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URL to the redirect_to function."
-          super({
-            :name=>"CVE-2008-5189",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2008, 11, 21),
-            :cwe=>"352",
-            :owasp=>"A8", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 2.0.5 or higher. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["http://weblog.rubyonrails.org/2008/10/19/response-splitting-risk"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['2.0.5', '1.9.999', '1.2.999', '1.1.999', '0.999.999']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2008_7248.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-09
-			class CVE_2008_7248
-				include DependencyCheck
-
-				def initialize
-          message = "Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain."
-          super({
-            :name=>"CVE-2008-7248",
-            :cvss=>"AV:N/AC:M/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2009, 12, 16),
-            :cwe=>"20",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 2.1.3 or 2.2.2 or higher. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["http://groups.google.com/group/rubyonrails-security/browse_thread/thread/d741ee286e36e301?hl=en"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['2.1.3', '2.2.2']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2009_4078.rb

@@ -1,29 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-09
-			class CVE_2009_4078
-				include DependencyCheck
-
-				def initialize
-          message = "Multiple cross-site scripting (XSS) vulnerabilities in Redmine 0.8.5 and earlier allow remote attackers to inject arbitrary web script or HTML via unspecified vectors."
-           super({
-            :name=>"CVE-2009-4078",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N", 
-            :release_date => Date.new(2009, 11, 25),
-            :cwe=>"79",
-            :owasp=>"A3", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade redmine version at least to 0.8.6 or higher. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["http://www.redmine.org/wiki/redmine/Changelog#v086-2009-11-04"]
-          })
-
-          self.safe_dependencies = [
-            {:name=>"redmine", :version=>['0.8.5', '0.7.999', '0.6.999', '0.5.999', '0.4.999', '0.3.999', '0.2.999', '0.1.999']}
-          ]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2009_4124.rb

@@ -1,30 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-09
-			class CVE_2009_4124
-				include RubyVersionCheck
-
-				def initialize
-          message = "Heap-based buffer overflow in the rb_str_justify function in string.c in Ruby 1.9.1 before 1.9.1-p376 allows context-dependent attackers to execute arbitrary code via unspecified vectors involving (1) String#ljust, (2) String#center, or (3) String#rjust. NOTE: some of these details are obtained from third party information."
-          super({
-            :name=>"CVE-2009-4124",
-            :cvss=>"AV:N/AC:L/Au:N/C:C/I:C/A:C",
-            :release_date => Date.new(2009, 12, 11),
-            :cwe=>"119",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/"]
-          })
-
-          self.safe_rubies = [
-            {:engine=>"ruby", :version=>"1.9.1", :patchlevel=>"p376"}, 
-          ]
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2009_4214.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-09
-			class CVE_2009_4214
-				include DependencyCheck
-
-				def initialize
-          message = "Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb."
-          super({
-            :name=>"CVE-2009-4214",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2009, 12, 7),
-            :cwe=>"79",
-            :owasp=>"A3", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 2.3.5 or higher. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["http://groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0ab?pli=1"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.5', '2.2.999', '2.1.999', '1.999.999', '0.999.999']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2010_1330.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-07-09
-			class CVE_2010_1330
-				include RubyVersionCheck
-
-				def initialize
-           message="The regular expression engine in JRuby before 1.4.1, when $KCODE is set to 'u', does not properly handle characters immediately after a UTF-8 character, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted string."
-           super({
-            :name=>"CVE-2010-1330",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2012, 11, 23),
-            :cwe=>"79",
-            :owasp=>"A3", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your jruby interpreter",
-            :aux_links=>["http://www.jruby.org/2010/04/26/jruby-1-4-1-xss-vulnerability.html"]
-          })
-
-          self.safe_rubies = [{:engine=>"jruby", :version=>"1.4.2", :patchlevel=>"p0"}]
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2010_2489.rb

@@ -1,60 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-09
-			class CVE_2010_2489_a
-        include RubyVersionCheck
-        
-        def initialize
-          message =  "CVE_2010_2489_a: ruby 1.9.2-p429  has problems"
-          super({
-            :name=>"CVE_2010_2489_a",
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-          })
-          self.safe_rubies = [
-            {:engine=>"ruby", :version=>"1.9.2", :patchlevel=>"p430"},
-            {:engine=>"ruby", :version=>"1.9.1", :patchlevel=>"p999"}, 
-            {:engine=>"ruby", :version=>"1.9.0", :patchlevel=>"p999"} 
-          ]
-        end
-      end
-
-      class CVE_2010_2489_b
-        include OperatingSystemCheck
-        def initialize
-          message =  "CVE_2010_2489_a: Only on Windows"
-          super({
-            :name=>"CVE_2010_2489_ab",
-            :kind=>Dawn::KnowledgeBase::OS_CHECK,
-          })
-
-          self.safe_os = [
-            {:family=>"windows", :vendor=>"microsoft", :version=>['none']}
-          ]
-
-        end
-
-      end
-
-			class CVE_2010_2489
-				include ComboCheck
-
-				def initialize
-          message = "Buffer overflow in Ruby 1.9.x before 1.9.1-p429 on Windows might allow local users to gain privileges via a crafted ARGF.inplace_mode value that is not properly handled when constructing the filenames of the backup files"
-          super({
-            :name=>"CVE-2010-2489",
-            :cvss=>"AV:L/AC:L/Au:N/C:C/I:C/A:C",
-            :release_date => Date.new(2010, 7, 10),
-            :cwe=>"119",
-            :owasp=>"A9", 
-            :applies=>["sinatra", "padrino", "rails"],
-            :kind=>Dawn::KnowledgeBase::COMBO_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade your ruby interpreter",
-            :aux_links=>["http://www.ruby-lang.org/en/news/2010/07/02/ruby-1-9-1-p429-is-released/"],
-            :checks=>[CVE_2010_2489_a.new, CVE_2010_2489_b.new]
-          })
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2010_3933.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-08
-			class CVE_2010_3933
-				include DependencyCheck
-
-				def initialize
-          message = "Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs."
-          super({
-            :name=>"CVE-2010-3933",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2010, 10, 28),
-            :cwe=>"20",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 2.3.10, 3.0.1 or higher. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["ttp://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.10', '3.0.1']}]
-
-				end
-			end
-		end
-	end