CVE-2011-2686: Medium severity ruby vulnerability
It was found that Ruby did not properly reinitialize the random number generator, when forking new Ruby process. A local attacker could use this flaw to easier predict random numbers.
References: [1] https://bugzilla.novell.com/showbug.cgi?id=704409 [2] http://www.ruby-lang.org/en/news/2011/07/02/ruby-1-8-7-p352-released/ [3] http://redmine.ruby-lang.org/issues/4579 [4] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=31713 [5] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=32050 [6] http://www.openwall.com/lists/oss-security/2011/07/11/1 [7] http://www.openwall.com/lists/oss-security/2011/07/12/14
Other sources
Ruby before 1.8.7-p352 does not reset the random seed upon forking, which makes it easier for context-dependent attackers to predict the values of random numbers by leveraging knowledge of the number sequence obtained in a different child process, a related issue to CVE-2003-0900. NOTE: this issue exists because of a regression during Ruby 1.8.6 development.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2686?
CVE-2011-2686 has been rated as a medium severity vulnerability due to its potential to allow local attackers to predict random numbers.
How do I fix CVE-2011-2686?
To fix CVE-2011-2686, users should update Ruby to a version that is not affected, specifically any version above 1.8.7-334.
What software versions are affected by CVE-2011-2686?
CVE-2011-2686 affects several versions of Ruby 1.8.7, including versions 1.8.7-160 through 1.8.7-334 inclusive.
Who can exploit CVE-2011-2686?
CVE-2011-2686 can be exploited by local attackers who can execute code in a Ruby environment.
What type of vulnerability is CVE-2011-2686 classified as?
CVE-2011-2686 is classified as a local information disclosure vulnerability.