386363 – (CVE-2011-3009) <dev-lang/ruby-1.8.6_p114: prng prediction (CVE-2011-3009)

Bug 386363 (CVE-2011-3009) - <dev-lang/ruby-1.8.6_p114: prng prediction (CVE-2011-3009)

Summary: <dev-lang/ruby-1.8.6_p114: prng prediction (CVE-2011-3009)

Status:	RESOLVED FIXED

Alias:	CVE-2011-3009

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor (vote)
Assignee:	Gentoo Security

URL:
Whiteboard:	B4 [noglsa]
Keywords:

Depends on:
Blocks:

Reported:	2011-10-08 15:34 UTC by GLSAMaker/CVETool Bot
Modified:	2012-12-12 00:57 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description GLSAMaker/CVETool Bot gentoo-dev

2011-10-08 15:34:33 UTC

CVE-2011-3009 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3009):
  Ruby before 1.8.6-p114 does not reset the random seed upon forking, which
  makes it easier for context-dependent attackers to predict the values of
  random numbers by leveraging knowledge of the number sequence obtained in a
  different child process, a related issue to CVE-2003-0900.

Comment 1 Agostino Sarubbo gentoo-dev

2012-10-03 07:49:28 UTC

Cleanup was done. please vote.

Comment 2 Tim Sammut (RETIRED) gentoo-dev

2012-12-11 17:26:29 UTC

Thanks, folks. GLSA Vote: no.

Comment 3 Sean Amoss (RETIRED) gentoo-dev

2012-12-12 00:57:06 UTC

GLSA vote: no, too.

Closing noglsa.