Ruby resolv.rb可预测事件ID和源端口DNS欺骗漏洞

2009-01-0600:00:00

Root

www.seebug.org

0.009 Low

EPSS

Percentile

81.0%

JSON

BUGTRAQ ID: 31699
CVE(CAN) ID: CVE-2008-3905

Ruby是一种功能强大的面向对象的脚本语言。

Ruby的resolv.rb对DNS请求使用了固定的源端口和顺序排列的事件ID，这允许远程攻击者相对容易的伪造DNS响应，扮演成中间人执行网络钓鱼等各种攻击。

Yukihiro Matsumoto Ruby 1.8.x
厂商补丁：

RedHat

RedHat已经为此发布了一个安全公告（RHSA-2008:0897-01）以及相应补丁:
RHSA-2008:0897-01：Moderate: ruby security update
链接：<a href=“https://www.redhat.com/support/errata/RHSA-2008-0897.html” target=“_blank”>https://www.redhat.com/support/errata/RHSA-2008-0897.html</a>

Gentoo

Gentoo已经为此发布了一个安全公告（GLSA-200812-17）以及相应补丁:
GLSA-200812-17：Ruby: Multiple vulnerabilities
链接：<a href=“http://security.gentoo.org/glsa/glsa-200812-17.xml” target=“_blank”>http://security.gentoo.org/glsa/glsa-200812-17.xml</a>

所有Ruby用户都应升级到最新版本：

# emerge --sync
# emerge --ask --oneshot --verbose &quot;&gt;=3Ddev-lang/ruby-1.8.6_p287-r1&quot;

Yukihiro Matsumoto

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：


                                                14:41:43.917837 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  0+ A? www.ruby-lang.org. (35) 
14:41:43.918776 IP *.*.*.*.domain &gt; *.*.*.*.32852:  0 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.920715 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  3787+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.921029 IP *.*.*.*.domain &gt; *.*.*.*.32853:  3787* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.925438 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  1+ A? www.ruby-lang.org. (35) 
14:41:43.925745 IP *.*.*.*.domain &gt; *.*.*.*.32852:  1 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.926152 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  27846+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.926440 IP *.*.*.*.domain &gt; *.*.*.*.32853:  27846* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.930274 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  2+ A? www.ruby-lang.org. (35) 
14:41:43.930571 IP *.*.*.*.domain &gt; *.*.*.*.32852:  2 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.930988 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  49648+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.931266 IP *.*.*.*.domain &gt; *.*.*.*.32853:  49648* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.935016 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  3+ A? www.ruby-lang.org. (35) 
14:41:43.935295 IP *.*.*.*.domain &gt; *.*.*.*.32852:  3 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.935697 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  4479+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.935971 IP *.*.*.*.domain &gt; *.*.*.*.32853:  4479* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.939750 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  4+ A? www.ruby-lang.org. (35) 
14:41:43.940020 IP *.*.*.*.domain &gt; *.*.*.*.32852:  4 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.940422 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  45762+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.940705 IP *.*.*.*.domain &gt; *.*.*.*.32853:  45762* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.944454 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  5+ A? www.ruby-lang.org. (35) 
14:41:43.944734 IP *.*.*.*.domain &gt; *.*.*.*.32852:  5 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.945129 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  13583+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.945392 IP *.*.*.*.domain &gt; *.*.*.*.32853:  13583* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.949186 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  6+ A? www.ruby-lang.org. (35) 
14:41:43.949446 IP *.*.*.*.domain &gt; *.*.*.*.32852:  6 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.949890 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  45038+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.950163 IP *.*.*.*.domain &gt; *.*.*.*.32853:  45038* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.953937 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  7+ A? www.ruby-lang.org. (35) 
14:41:43.954225 IP *.*.*.*.domain &gt; *.*.*.*.32852:  7 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.954593 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  27150+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.954859 IP *.*.*.*.domain &gt; *.*.*.*.32853:  27150* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.958667 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  8+ A? www.ruby-lang.org. (35) 
14:41:43.958943 IP *.*.*.*.domain &gt; *.*.*.*.32852:  8 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.959335 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  27956+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.959613 IP *.*.*.*.domain &gt; *.*.*.*.32853:  27956* 1/3/4 PTR some.name.of.the.host. (217)
14:41:43.963347 IP *.*.*.*.32852 &gt; *.*.*.*.domain:  9+ A? www.ruby-lang.org. (35) 
14:41:43.963632 IP *.*.*.*.domain &gt; *.*.*.*.32852:  9 2/2/4 CNAME carbon.ruby-lang.org., A 221.186.184.68 (211)
14:41:43.964015 IP *.*.*.*.32853 &gt; *.*.*.*.domain:  19992+ PTR? rev.dns.rec.some.name.of.the.host.in-addr.arpa. (43)
14:41:43.964282 IP *.*.*.*.domain &gt; *.*.*.*.32853:  19992* 1/3/4 PTR some.name.of.the.host. (217)