dawnscanner 1.6.9 → 2.0.0.rc1

data/lib/dawn/kb/cve_2011_2932.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-30
-			class CVE_2011_2932
-				include DependencyCheck
-
-				def initialize
-          message = "Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a malformed Unicode string, related to a \"UTF-8 escaping vulnerability.\""
-          super({
-            :name=>"CVE-2011-2932",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2011, 8, 29),
-            :cwe=>"79",
-            :owasp=>"A3", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 2.3.13, 3.0.10, 3.1.0. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["http://secunia.com/advisories/45917"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.13', '3.0.10', '3.1.0']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2011_3009.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-08
-			class CVE_2011_3009
-				include RubyVersionCheck
-
-				def initialize
-          message = "Ruby before 1.8.6-p114 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900."
-
-          super({
-            :name=>"CVE-2011-3009",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",
-            :release_date => Date.new(2011, 8, 11),
-            :cwe=>"310",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby interpreter",
-            :aux_links=>["http://www.openwall.com/lists/oss-security/2011/07/20/1"]
-          })
-
-          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.6", :patchlevel=>"p112"}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2011_3186.rb

@@ -1,29 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-29
-			class CVE_2011_3186
-				include DependencyCheck
-
-				def initialize
-          message="CRLF injection vulnerability in actionpack/lib/action_controller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header."
-
-          super({
-            :name=>"CVE-2011-3186",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2011, 8, 29),
-            :cwe=>"94",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 2.3.13. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["https://github.com/rails/rails/commit/11dafeaa7533be26441a63618be93a03869c83a9"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.13']}]
- 
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2011_3187.rb

@@ -1,29 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-08
-			class CVE_2011_3187
-				include DependencyCheck
-
-				def initialize
-          message = "The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header."
-
-          super({
-            :name=>"CVE-2011-3187",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2011, 8, 29),
-            :cwe=>"20",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails to version 3.0.6. As a general rule, using the latest stable version is recommended.",
-            :aux_links=>["http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0337.html"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['3.0.6']}]
-          self.save_major = true
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2011_4319.rb

@@ -1,30 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-08
-			class CVE_2011_4319
-				include DependencyCheck
-
-				def initialize
-          message = "Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the rails_xss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an \"html\" substring."
-
-          super({
-            :name=>"CVE-2011-4319",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2011, 11, 28),
-            :cwe=>"79",
-            :owasp=>"A3", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails to version 3.0.11, 3.1.2 or a version up to 2.3.12 if you are stuck on 2.3.x branch . As a general rule, using the latest stable version is recommended.",
-            :aux_links=>["http://groups.google.com/group/rubyonrails-security/msg/c65c24fbc4b6dd82?dmode=source&output=gplain"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.13', '3.0.11', '3.1.2']}]
-          self.save_major = true
-          self.save_minor = true
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2011_4815.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-07-12
-			class CVE_2011_4815
-				include RubyVersionCheck
-
-				def initialize
-          message = "Ruby (aka CRuby) before 1.8.7-p357 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table."
-          super({
-            :name=>"CVE-2011-4815",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:C",
-            :release_date => Date.new(2011, 12, 30),
-            :cwe=>"20",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::RUBY_VERSION_CHECK,
-            :message=>message,
-            :mitigation=>"Upgrade your ruby to latest available version",
-            :aux_links=>["http://www.ruby-lang.org/en/news/2011/12/28/denial-of-service-attack-was-found-for-rubys-hash-algorithm/"]
-          })
-
-          self.safe_rubies = [{:engine=>"ruby", :version=>"1.8.7", :patchlevel=>"p357"}]
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2011_5036.rb

@@ -1,26 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-02-06
-			class CVE_2011_5036
-				include DependencyCheck
-
-				def initialize
-          message = "Rack before 1.1.3, 1.2.x before 1.2.5, and 1.3.x before 1.3.6 computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters."
-
-          super({
-            :name=>"CVE-2011-5036",
-            :cvss=>"AV:N/AC:L/Au:N/C:N/I:N/A:P",
-            :release_date => Date.new(2011, 12, 30),
-            :cwe=>"310",
-            :owasp=>"A9", 
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rack version up to version 1.3.6, 1.2.5, 1.1.3 or higher.",
-            :aux_links=>["https://gist.github.com/52bbc6b9cc19ce330829"]
-          })
-          self.safe_dependencies = [{:name=>"rack", :version=>['1.3.6', '1.2.5', '1.1.3', '1.0.9999', '0.9.9999', '0.4.9999', '0.3.9999', '0.2.9999', '0.1.9999']}]
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2012_1098.rb

@@ -1,30 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-14
-			class CVE_2012_1098
-				include DependencyCheck
-
-				def initialize
-          message = "Cross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods."
-
-          super({
-            :name=>"CVE-2012-1098",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2012, 3, 13),
-            :cwe=>"79",
-            :owasp=>"A3", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 3.0.12, 3.1.4 and 3.2.2. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['3.0.12', '3.1.4', '3.2.2']}]
-          self.save_major = true
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2012_1099.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-30
-			class CVE_2012_1099
-				include DependencyCheck
-
-				def initialize
-          message = "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_options_helper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements."
-          super({
-            :name=>"CVE-2012-1099",
-            :cvss=>"AV:N/AC:M/Au:N/C:N/I:P/A:N",
-            :release_date => Date.new(2012, 3, 13),
-            :cwe=>"79",
-            :owasp=>"A3", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 3.0.12, 3.1.4 and 3.2.2. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['3.0.12', '3.1.4', '3.2.2']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2012_1241.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-30
-			class CVE_2012_1241
-				include DependencyCheck
-
-				def initialize
-          message="GRScript18.dll before 1.2.2.0 in ActiveScriptRuby (ASR) before 1.8.7 does not properly restrict interaction with an Internet Explorer ActiveX environment, which allows remote attackers to execute arbitrary Ruby code via a crafted HTML document."
-          super({
-            :name=>"CVE-2012-1241",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2012, 4, 16),
-            :cwe=>"264",
-            :owasp=>"A9", 
-            :applies=>["rails", "padrino", "sinatra"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade ActiveScriptRuby to version 1.8.7. As a general rule, using the latest stable version is recommended.",
-            :aux_links=>["https://github.com/rails/rails/commit/11dafeaa7533be26441a63618be93a03869c83a9"]
-          })
-
-          self.safe_dependencies = [{:name=>"activescriptruby", :version=>['1.8.7']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2012_2139.rb

@@ -1,26 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-14
-			class CVE_2012_2139
-				include DependencyCheck
-
-				def initialize
-          message = "Directory traversal vulnerability in lib/mail/network/delivery_methods/file_delivery.rb in the Mail gem before 2.4.4 for Ruby allows remote attackers to read arbitrary files via a .. (dot dot) in the to parameter."
-          super({
-            :name=>'CVE-2012-2139', 
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",  
-            :release_date => Date.new(2012, 7, 17),
-            :cwe=>"22", 
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind => Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message => message,
-            :mitigation=>"Please upgrade mail_gem version up to 2.4.4. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links => ["https://github.com/mikel/mail/commit/29aca25218e4c82991400eb9b0c933626aefc98f"]
-          })
-          self.safe_dependencies = [{:name=>"mail_gem", :version=>['2.4.4', '2.3.999']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2012_2140.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-30
-			class CVE_2012_2140
-				include DependencyCheck
-
-				def initialize
-          message = "The Mail gem before 2.4.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a (1) sendmail or (2) exim delivery."
-          super({
-            :name=>"CVE-2012-2140",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",
-            :release_date => Date.new(2012, 7, 18),
-            :cwe=>"20",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade Mail gem version to version 2.4.3. As a general rule, using the latest stable version is recommended.",
-            :aux_links=>["http://secunia.com/advisories/48970"]
-          })
-
-          self.safe_dependencies = [{:name=>"mail_gem", :version=>['2.4.3', '2.3.4']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2012_2660.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-02
-			class CVE_2012_2660
-				include DependencyCheck
-
-				def initialize
-          message = "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2694."
-
-          super({
-            :name=>"CVE-2012-2660",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:N",
-            :release_date => Date.new(2012, 6, 22),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 2.3.15, 3.2.5, 3.1.5 or 3.0.13. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["https://groups.google.com/d/topic/rubyonrails-security/8SA-M3as7A8/discussion"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.15', '3.0.13', '3.2.5', '3.1.5']}]
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2012_2661.rb

@@ -1,27 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-06
-			class CVE_2012_2661
-				include DependencyCheck
-
-				def initialize
-          message = "The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695."
-
-          super({
-            :name=>"CVE-2012-2661",
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:N/A:N",
-            :release_date => Date.new(2012, 6, 22),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 3.2.5, 3.1.5 or 3.0.13. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["https://groups.google.com/d/topic/rubyonrails-security/dUaiOOGWL1k/discussion"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['3.0.13', '3.2.5', '3.1.5']}]
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2012_2671.rb

@@ -1,28 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2014-01-14
-			class CVE_2012_2671
-				include DependencyCheck
-
-				def initialize
-          message = "The Rack::Cache rubygem 0.3.0 through 1.1 caches Set-Cookie and other sensitive headers, which allows attackers to obtain sensitive cookie information, hijack web sessions, or have other unspecified impact by accessing the cache."
-
-          super({
-            :name=>'CVE-2012-2671', 
-            :cvss=>"AV:N/AC:L/Au:N/C:P/I:P/A:P",  
-            :release_date => Date.new(2012, 6, 17),
-            :cwe=>"", 
-            :owasp=>"A9",
-            :applies=>["rails", "sinatra", "padrino"],
-            :kind => Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message => message,
-            :mitigation=>"Please upgrade ruby-cache version up to 1.1.1. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links => ["https://github.com/rtomayko/rack-cache/pull/52"]
-          })
-          self.safe_dependencies = [{:name=>"rack-cache", :version=>['0.9999.9999', '1.1.2']}]
-
-
-				end
-			end
-		end
-	end

data/lib/dawn/kb/cve_2012_2694.rb

@@ -1,30 +0,0 @@
-	module Dawn
-		module Kb
-			# Automatically created with rake on 2013-05-03
-			class CVE_2012_2694
-				include DependencyCheck
-
-				def initialize
-          message = "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"['xyz', nil]\" values, a related issue to CVE-2012-2660."
-
-          super({
-            :name=>"CVE-2012-2694",
-            :cvss=>"AV:N/AC:M/Au:N/C:P/I:N/A:N",
-            :release_date => Date.new(2012, 6, 22),
-            :cwe=>"",
-            :owasp=>"A9", 
-            :applies=>["rails"],
-            :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
-            :message=>message,
-            :mitigation=>"Please upgrade rails version at least to 2.3.15, 3.2.6, 3.1.6 or 3.0.14. As a general rule, using the latest stable rails version is recommended.",
-            :aux_links=>["https://groups.google.com/d/topic/rubyonrails-security/l4L0TEVAz1k/discussion"]
-          })
-
-          self.safe_dependencies = [{:name=>"rails", :version=>['2.3.15', '3.0.14', '3.2.6', '3.1.6']}]
-
-
-
-				end
-			end
-		end
-	end