Vulnerability CVE-2015-4020

Vulnerability Name:

CVE-2015-4020 (CCN-104100)

Assigned:

2015-06-08

Published:

2015-06-08

Updated:

2017-12-09

Summary:

RubyGems 2.0.x before 2.0.17, 2.2.x before 2.2.5, and 2.4.x before 2.4.8 does not validate the hostname when fetching gems or making API requests, which allows remote attackers to redirect requests to arbitrary domains via a crafted DNS SRV record with a domain that is suffixed with the original domain name, aka a "DNS hijack attack."
Note: this vulnerability exists because to an incomplete fix for CVE-2015-3900.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-20

Vulnerability Consequences:

Gain Access

References:

Source: CONFIRM
Type: Vendor Advisory
http://blog.rubygems.org/2015/06/08/2.2.5-released.html

Source: CONFIRM
Type: Vendor Advisory
http://blog.rubygems.org/2015/06/08/2.4.8-released.html

Source: MITRE
Type: CNA
CVE-2015-4020

Source: CCN
Type: oss-security Mailing List, Fri, 26 Jun 2015 02:10:40 -0700
rubygems <2.4.8 vulnerable to DNS request hijacking (CVE-2015-3900 and CVE-2015-4020)

Source: CONFIRM
Type: Third Party Advisory
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

Source: BID
Type: UNKNOWN
75431

Source: XF
Type: UNKNOWN
rubygems-cve20154020-hijacking(104100)

Source: CONFIRM
Type: UNKNOWN
https://github.com/rubygems/rubygems/commit/5c7bfb5

Source: CONFIRM
Type: UNKNOWN
https://puppet.com/security/cve/CVE-2015-3900

Source: CCN
Type: Trustwave SpiderLabs Security Advisory TWSL2015-009
Request Hijacking Bypass Vulnerability In RubyGems

Source: MISC
Type: Third Party Advisory
https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2015-009/?fid=6478

Source: MISC
Type: Third Party Advisory
https://www.trustwave.com/Resources/SpiderLabs-Blog/Attacking-Ruby-Gem-Security-with-CVE-2015-3900/

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2015-4020

Vulnerable Configuration:

Configuration 1:

cpe:/o:oracle:solaris:11.3:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:rubygems:rubygems:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.0:preview2:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.0:preview2.1:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.0:preview2.2:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.0:rc1:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.0:rc2:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.6:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.7:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.8:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.9:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.10:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.11:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.12:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.13:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.14:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.15:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.0.16:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.2.1:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.2.2:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.2.3:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.2.4:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.4.0:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.4.1:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.4.2:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.4.3:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.4.4:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.4.5:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.4.6:*:*:*:*:*:*:*

OR cpe:/a:rubygems:rubygems:2.4.7:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.precise:def:20154020000	V	CVE-2015-4020 on Ubuntu 12.04 LTS (precise) - low.	2015-08-25
oval:com.ubuntu.trusty:def:20154020000	V	CVE-2015-4020 on Ubuntu 14.04 LTS (trusty) - low.	2015-08-25

BACK