class Dawn::Kb::CVE_2013_2513

Automatically created with rake on 2014-02-07

Public Class Methods

new() click to toggle source
Calls superclass method Dawn::Kb::DependencyCheck::new
# File lib/dawn/kb/cve_2013_2513.rb, line 7
                      def initialize
message = "flash_tool Gem for Ruby contains a flaw that is triggered during the handling of downloaded files that contain shell characters. With a specially crafted file, a context-dependent attacker can execute arbitrary commands."
super({
  :name=>"CVE-2013-2513",
  :cvss=>"",
  :release_date => Date.new(2013, 3, 4),
  :cwe=>"",
  :owasp=>"A9", 
  :applies=>["rails", "sinatra", "padrino"],
  :kind=>Dawn::KnowledgeBase::DEPENDENCY_CHECK,
  :message=>message,
  :mitigation=>"At the time of writing this, there is no solution to this vulnerability by software upgrade since latest version is still 0.6.0. You may want to sanitize your input before passing to offendend library.",
  :aux_links=>["http://packetstormsecurity.com/files/120626/Flash-Tool-0.6.0-Remote-Code-Execution.html"]
})
self.safe_dependencies = [{:name=>"flash_tool", :version=>['0.6.1']}]
                      end