Some security issues have been reported in Ruby, which can be exploited by malicious people to conduct spoofing attacks.

The security issues are caused due to the "net::https", "net::ftptls", "net::telnets", and "net::imap" modules not properly checking if the Common Name field provided inside SSL server certificates matches the requested hostname of a server. This can be exploited to conduct spoofing attacks.

Successful exploitation requires a MitM (Man-in-the-Middle) attack and possession of a valid certificate, which is signed by the CA specified in the client.

The security issues are reported in version 1.8.5 and 1.8.6.

Solution
Fixed in SVN repository.

Provided and/or discovered by
Chris Clark, iSEC Partners
Additionally affected modules reported by the vendor.

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://www.isecpartners.com/advisories/2007-006-rubyssl.txt
http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656

Deep Links
Links available to Secunia VIM customers