Full Disclosure: [SECURITY] [DSA-1234-1] New ruby1.6 package fix denial of service

From: Steve Kemp <skx_at_debian.org>
Date: Wed, 13 Dec 2006 12:12:07 +0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1234-1 security_at_debian.org
http://www.debian.org/security/ Steve Kemp
December 13, 2006
- ------------------------------------------------------------------------

Package : ruby1.6 (1.6.8-12sarge3)
Vulnerability : Denial of service
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2006-5467
Debian Bug : 398457

A denial of service vulnerability has been discovered in the CGI library
included with Ruby, the intepreted scripting langauge for quick and easy
object-orientated programming.

For the stable distribution (sarge), this problem has been fixed in version
1.6.8-12sarge3.

We recommend that you upgrade your ruby1.6 package.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian 3.1 (stable)
- -------------------

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/r/ruby1.6/ruby1.6_1.6.8-12sarge3.dsc
    Size/MD5 checksum: 995 afe54a8363d4d14b066f32b07b095dde
  http://security.debian.org/pool/updates/main/r/ruby1.6/ruby1.6_1.6.8-12sarge3.diff.gz
    Size/MD5 checksum: 78860 73e5ba7c3a427ceb1bf4926cf9e440a9
  http://security.debian.org/pool/updates/main/r/ruby1.6/ruby1.6_1.6.8.orig.tar.gz
    Size/MD5 checksum: 1022364 aa1e272added83a5206c565d62c9c8ed

Architecture independent packages:

  http://security.debian.org/pool/updates/main/r/ruby1.6/ruby1.6-elisp_1.6.8-12sarge3_all.deb
    Size/MD5 checksum: 152700 0086c6b5b4d81a689ec8ab938e495e33
  http://security.debian.org/pool/updates/main/r/ruby1.6/ruby1.6-examples_1.6.8-12sarge3_all.deb
    Size/MD5 checksum: 160374 ad819f654e8b072a38ebbf2e6aa24fd5
  http://security.debian.org/pool/updates/main/r/ruby1.6/irb1.6_1.6.8-12sarge3_all.deb
    Size/MD5 checksum: 174876 7518ee339c9c8450d13097c25d1ab034

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

m68k architecture (Motorola Mc680x0)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce_at_lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFFf+3jwM/Gs81MDZ0RAvH6AJ9ovjhIS/RtktqWaMAWAyGFuPay7wCg0g/R
i8HTUq3FG9qbC4pm0KKBCsw=
=dGsu
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Dec 13 2006