Ruby resolv.rb可预测事件ID和源端口DNS欺骗漏洞

2009-01-06T00:00:00
ID SSV:4620
Type seebug
Reporter Root
Modified 2009-01-06T00:00:00

Description

BUGTRAQ ID: 31699 CVE(CAN) ID: CVE-2008-3905

Ruby是一种功能强大的面向对象的脚本语言。

Ruby的resolv.rb对DNS请求使用了固定的源端口和顺序排列的事件ID,这允许远程攻击者相对容易的伪造DNS响应,扮演成中间人执行网络钓鱼等各种攻击。

Yukihiro Matsumoto Ruby 1.8.x 厂商补丁:

RedHat

RedHat已经为此发布了一个安全公告(RHSA-2008:0897-01)以及相应补丁: RHSA-2008:0897-01:Moderate: ruby security update 链接:<a href=https://www.redhat.com/support/errata/RHSA-2008-0897.html target=_blank rel=external nofollow>https://www.redhat.com/support/errata/RHSA-2008-0897.html</a>

Gentoo

Gentoo已经为此发布了一个安全公告(GLSA-200812-17)以及相应补丁: GLSA-200812-17:Ruby: Multiple vulnerabilities 链接:<a href=http://security.gentoo.org/glsa/glsa-200812-17.xml target=_blank rel=external nofollow>http://security.gentoo.org/glsa/glsa-200812-17.xml</a>

所有Ruby用户都应升级到最新版本:

# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=3Ddev-lang/ruby-1.8.6_p287-r1&quot;

Yukihiro Matsumoto

目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:

<a href=ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.tar.gz target=_blank rel=external nofollow>ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.tar.gz</a> <a href=ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.tar.gz target=_blank rel=external nofollow>ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.6-p287.tar.gz</a>

                                        
                                            
                                                14:41:43.917837 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  0+ A? www.ruby-lang.org. (35) 
14:41:43.918776 IP *.*.*.*.domain &gt; *.*.*.*.32852:  0 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.920715 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  3787+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.921029 IP *.*.*.*.domain &gt; *.*.*.*.32853:  3787* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.925438 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  1+ A? www.ruby-lang.org. (35) 
14:41:43.925745 IP *.*.*.*.domain &gt; *.*.*.*.32852:  1 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.926152 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  27846+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.926440 IP *.*.*.*.domain &gt; *.*.*.*.32853:  27846* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.930274 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  2+ A? www.ruby-lang.org. (35) 
14:41:43.930571 IP *.*.*.*.domain &gt; *.*.*.*.32852:  2 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.930988 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  49648+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.931266 IP *.*.*.*.domain &gt; *.*.*.*.32853:  49648* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.935016 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  3+ A? www.ruby-lang.org. (35) 
14:41:43.935295 IP *.*.*.*.domain &gt; *.*.*.*.32852:  3 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.935697 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  4479+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.935971 IP *.*.*.*.domain &gt; *.*.*.*.32853:  4479* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.939750 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  4+ A? www.ruby-lang.org. (35) 
14:41:43.940020 IP *.*.*.*.domain &gt; *.*.*.*.32852:  4 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.940422 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  45762+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.940705 IP *.*.*.*.domain &gt; *.*.*.*.32853:  45762* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.944454 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  5+ A? www.ruby-lang.org. (35) 
14:41:43.944734 IP *.*.*.*.domain &gt; *.*.*.*.32852:  5 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.945129 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  13583+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.945392 IP *.*.*.*.domain &gt; *.*.*.*.32853:  13583* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.949186 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  6+ A? www.ruby-lang.org. (35) 
14:41:43.949446 IP *.*.*.*.domain &gt; *.*.*.*.32852:  6 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.949890 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  45038+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.950163 IP *.*.*.*.domain &gt; *.*.*.*.32853:  45038* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.953937 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  7+ A? www.ruby-lang.org. (35) 
14:41:43.954225 IP *.*.*.*.domain &gt; *.*.*.*.32852:  7 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.954593 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  27150+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.954859 IP *.*.*.*.domain &gt; *.*.*.*.32853:  27150* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.958667 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  8+ A? www.ruby-lang.org. (35) 
14:41:43.958943 IP *.*.*.*.domain &gt; *.*.*.*.32852:  8 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.959335 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  27956+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.959613 IP *.*.*.*.domain &gt; *.*.*.*.32853:  27956* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.963347 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  9+ A? www.ruby-lang.org. (35) 
14:41:43.963632 IP *.*.*.*.domain &gt; *.*.*.*.32852:  9 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.964015 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  19992+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.964282 IP *.*.*.*.domain &gt; *.*.*.*.32853:  19992* 1/3/4 PTR some.name.of.the.host. (217)