security@mandriva.com
26/04/06, 18:00
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
__________________________________________________ _____________________
Mandriva Linux Security Advisory MDKSA-2006:079
http://www.mandriva.com/security/
__________________________________________________ _____________________
Package : ruby
Date : April 25, 2006
Affected: 10.2, 2006.0, Corporate 3.0
__________________________________________________ _____________________
Problem Description:
A vulnerability in how ruby's HTTP module uses blocking sockets was
reported by Yukihiro Matsumoto. By sending large amounts of data to a
server application using this module, a remote attacker could exploit
it to render the application unusable and not respond to other client
requests.
The updated packages have been patched to fix this problem.
__________________________________________________ _____________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1931
__________________________________________________ _____________________
Updated Packages:
Mandriva Linux 10.2:
f9745c919a26b88653c1bb8d65b22656 10.2/RPMS/ruby-1.8.2-6.3.102mdk.i586.rpm
a70aa5e8d43962a8e1432eba455550a1 10.2/RPMS/ruby-devel-1.8.2-6.3.102mdk.i586.rpm
ef56fa7d95bb07869fd990174fba0a80 10.2/RPMS/ruby-doc-1.8.2-6.3.102mdk.i586.rpm
46cf35ec68925266be3476e0e2244dba 10.2/RPMS/ruby-tk-1.8.2-6.3.102mdk.i586.rpm
9a297ac138f1be885dbf9bdb3f963dca 10.2/SRPMS/ruby-1.8.2-6.3.102mdk.src.rpm
Mandriva Linux 10.2/X86_64:
7a961ba32e721306fc18cc84138131fa x86_64/10.2/RPMS/ruby-1.8.2-6.3.102mdk.x86_64.rpm
6215d5fe2525ddcaf47b22443be40d29 x86_64/10.2/RPMS/ruby-devel-1.8.2-6.3.102mdk.x86_64.rpm
6bf001166ce1fe417513be0da4afa983 x86_64/10.2/RPMS/ruby-doc-1.8.2-6.3.102mdk.x86_64.rpm
dc54e4e1cb352e2a31578b528b0fae24 x86_64/10.2/RPMS/ruby-tk-1.8.2-6.3.102mdk.x86_64.rpm
9a297ac138f1be885dbf9bdb3f963dca x86_64/10.2/SRPMS/ruby-1.8.2-6.3.102mdk.src.rpm
Mandriva Linux 2006.0:
3144dc749cdb9da398064c2cf34103fe 2006.0/RPMS/ruby-1.8.2-7.2.20060mdk.i586.rpm
1bf85e3cd1456dbda21fd95f1626b28f 2006.0/RPMS/ruby-devel-1.8.2-7.2.20060mdk.i586.rpm
80000d9bf73c957174c6ce8a7c637147 2006.0/RPMS/ruby-doc-1.8.2-7.2.20060mdk.i586.rpm
272d3970702ec07e44a0469d1f431380 2006.0/RPMS/ruby-tk-1.8.2-7.2.20060mdk.i586.rpm
5cd34c71849ac8eebe80c6389178a5a8 2006.0/SRPMS/ruby-1.8.2-7.2.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
c032856335423079f3a68b7eeaeda281 x86_64/2006.0/RPMS/ruby-1.8.2-7.2.20060mdk.x86_64.rpm
aa44a1b8179d94c3ef4504d504fdb01b x86_64/2006.0/RPMS/ruby-devel-1.8.2-7.2.20060mdk.x86_64.rpm
a409a90806495d8a074fa15d9191d053 x86_64/2006.0/RPMS/ruby-doc-1.8.2-7.2.20060mdk.x86_64.rpm
4a13e6ade495ac6c2d6068d88674d396 x86_64/2006.0/RPMS/ruby-tk-1.8.2-7.2.20060mdk.x86_64.rpm
5cd34c71849ac8eebe80c6389178a5a8 x86_64/2006.0/SRPMS/ruby-1.8.2-7.2.20060mdk.src.rpm
Corporate 3.0:
249f78bda13201aecd66a30379a23209 corporate/3.0/RPMS/ruby-1.8.1-1.5.C30mdk.i586.rpm
210ae59468330f26d71496c636fc4dcc corporate/3.0/RPMS/ruby-devel-1.8.1-1.5.C30mdk.i586.rpm
a69109163c0cd1c22616dce20e4924cf corporate/3.0/RPMS/ruby-doc-1.8.1-1.5.C30mdk.i586.rpm
cbfdf5cab0ae9c82731a94ef51f60e41 corporate/3.0/RPMS/ruby-tk-1.8.1-1.5.C30mdk.i586.rpm
7db43332f4a6cd0d6f530f2e423315ac corporate/3.0/SRPMS/ruby-1.8.1-1.5.C30mdk.src.rpm
Corporate 3.0/X86_64:
3ec5b89b32196866594ac0fbeb852e66 x86_64/corporate/3.0/RPMS/ruby-1.8.1-1.5.C30mdk.x86_64.rpm
63df0377e01145f410075b7122c1e541 x86_64/corporate/3.0/RPMS/ruby-devel-1.8.1-1.5.C30mdk.x86_64.rpm
54580e762f81bceb21bc62aa7f4f934b x86_64/corporate/3.0/RPMS/ruby-doc-1.8.1-1.5.C30mdk.x86_64.rpm
f8e720ecbeafc2dceb8522272b213e08 x86_64/corporate/3.0/RPMS/ruby-tk-1.8.1-1.5.C30mdk.x86_64.rpm
7db43332f4a6cd0d6f530f2e423315ac x86_64/corporate/3.0/SRPMS/ruby-1.8.1-1.5.C30mdk.src.rpm
__________________________________________________ _____________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
__________________________________________________ _____________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFEToPBmqjQ0CJFipgRAjYgAJ9tf1nRJZhBInVNILG53l Qvy1nTOwCfQtJu
yoIIcgaXpYqbHvIzbKdUL04=
=FxkL
-----END PGP SIGNATURE-----
Hash: SHA1
__________________________________________________ _____________________
Mandriva Linux Security Advisory MDKSA-2006:079
http://www.mandriva.com/security/
__________________________________________________ _____________________
Package : ruby
Date : April 25, 2006
Affected: 10.2, 2006.0, Corporate 3.0
__________________________________________________ _____________________
Problem Description:
A vulnerability in how ruby's HTTP module uses blocking sockets was
reported by Yukihiro Matsumoto. By sending large amounts of data to a
server application using this module, a remote attacker could exploit
it to render the application unusable and not respond to other client
requests.
The updated packages have been patched to fix this problem.
__________________________________________________ _____________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1931
__________________________________________________ _____________________
Updated Packages:
Mandriva Linux 10.2:
f9745c919a26b88653c1bb8d65b22656 10.2/RPMS/ruby-1.8.2-6.3.102mdk.i586.rpm
a70aa5e8d43962a8e1432eba455550a1 10.2/RPMS/ruby-devel-1.8.2-6.3.102mdk.i586.rpm
ef56fa7d95bb07869fd990174fba0a80 10.2/RPMS/ruby-doc-1.8.2-6.3.102mdk.i586.rpm
46cf35ec68925266be3476e0e2244dba 10.2/RPMS/ruby-tk-1.8.2-6.3.102mdk.i586.rpm
9a297ac138f1be885dbf9bdb3f963dca 10.2/SRPMS/ruby-1.8.2-6.3.102mdk.src.rpm
Mandriva Linux 10.2/X86_64:
7a961ba32e721306fc18cc84138131fa x86_64/10.2/RPMS/ruby-1.8.2-6.3.102mdk.x86_64.rpm
6215d5fe2525ddcaf47b22443be40d29 x86_64/10.2/RPMS/ruby-devel-1.8.2-6.3.102mdk.x86_64.rpm
6bf001166ce1fe417513be0da4afa983 x86_64/10.2/RPMS/ruby-doc-1.8.2-6.3.102mdk.x86_64.rpm
dc54e4e1cb352e2a31578b528b0fae24 x86_64/10.2/RPMS/ruby-tk-1.8.2-6.3.102mdk.x86_64.rpm
9a297ac138f1be885dbf9bdb3f963dca x86_64/10.2/SRPMS/ruby-1.8.2-6.3.102mdk.src.rpm
Mandriva Linux 2006.0:
3144dc749cdb9da398064c2cf34103fe 2006.0/RPMS/ruby-1.8.2-7.2.20060mdk.i586.rpm
1bf85e3cd1456dbda21fd95f1626b28f 2006.0/RPMS/ruby-devel-1.8.2-7.2.20060mdk.i586.rpm
80000d9bf73c957174c6ce8a7c637147 2006.0/RPMS/ruby-doc-1.8.2-7.2.20060mdk.i586.rpm
272d3970702ec07e44a0469d1f431380 2006.0/RPMS/ruby-tk-1.8.2-7.2.20060mdk.i586.rpm
5cd34c71849ac8eebe80c6389178a5a8 2006.0/SRPMS/ruby-1.8.2-7.2.20060mdk.src.rpm
Mandriva Linux 2006.0/X86_64:
c032856335423079f3a68b7eeaeda281 x86_64/2006.0/RPMS/ruby-1.8.2-7.2.20060mdk.x86_64.rpm
aa44a1b8179d94c3ef4504d504fdb01b x86_64/2006.0/RPMS/ruby-devel-1.8.2-7.2.20060mdk.x86_64.rpm
a409a90806495d8a074fa15d9191d053 x86_64/2006.0/RPMS/ruby-doc-1.8.2-7.2.20060mdk.x86_64.rpm
4a13e6ade495ac6c2d6068d88674d396 x86_64/2006.0/RPMS/ruby-tk-1.8.2-7.2.20060mdk.x86_64.rpm
5cd34c71849ac8eebe80c6389178a5a8 x86_64/2006.0/SRPMS/ruby-1.8.2-7.2.20060mdk.src.rpm
Corporate 3.0:
249f78bda13201aecd66a30379a23209 corporate/3.0/RPMS/ruby-1.8.1-1.5.C30mdk.i586.rpm
210ae59468330f26d71496c636fc4dcc corporate/3.0/RPMS/ruby-devel-1.8.1-1.5.C30mdk.i586.rpm
a69109163c0cd1c22616dce20e4924cf corporate/3.0/RPMS/ruby-doc-1.8.1-1.5.C30mdk.i586.rpm
cbfdf5cab0ae9c82731a94ef51f60e41 corporate/3.0/RPMS/ruby-tk-1.8.1-1.5.C30mdk.i586.rpm
7db43332f4a6cd0d6f530f2e423315ac corporate/3.0/SRPMS/ruby-1.8.1-1.5.C30mdk.src.rpm
Corporate 3.0/X86_64:
3ec5b89b32196866594ac0fbeb852e66 x86_64/corporate/3.0/RPMS/ruby-1.8.1-1.5.C30mdk.x86_64.rpm
63df0377e01145f410075b7122c1e541 x86_64/corporate/3.0/RPMS/ruby-devel-1.8.1-1.5.C30mdk.x86_64.rpm
54580e762f81bceb21bc62aa7f4f934b x86_64/corporate/3.0/RPMS/ruby-doc-1.8.1-1.5.C30mdk.x86_64.rpm
f8e720ecbeafc2dceb8522272b213e08 x86_64/corporate/3.0/RPMS/ruby-tk-1.8.1-1.5.C30mdk.x86_64.rpm
7db43332f4a6cd0d6f530f2e423315ac x86_64/corporate/3.0/SRPMS/ruby-1.8.1-1.5.C30mdk.src.rpm
__________________________________________________ _____________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
__________________________________________________ _____________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2.2 (GNU/Linux)
iD8DBQFEToPBmqjQ0CJFipgRAjYgAJ9tf1nRJZhBInVNILG53l Qvy1nTOwCfQtJu
yoIIcgaXpYqbHvIzbKdUL04=
=FxkL
-----END PGP SIGNATURE-----