Full Disclosure mailing list archives
[ GLSA 200912-02 ] Ruby on Rails: Multiple vulnerabilities
From: Alex Legler <a3li () gentoo org>
Date: Sun, 20 Dec 2009 12:33:32 +0100
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200912-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Ruby on Rails: Multiple vulnerabilities Date: December 20, 2009 Bugs: #200159, #237385, #247549, #276279, #283396, #294797 ID: 200912-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been discovered in Rails, the worst of which leading to the execution of arbitrary SQL statements. Background ========== Ruby on Rails is a web-application and persistence framework. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-ruby/rails < 2.2.2 >= 2.3.5 *>= 2.2.3-r1 Description =========== The following vulnerabilities were discovered: * sameer reported that lib/action_controller/cgi_process.rb removes the :cookie_only attribute from the default session options (CVE-2007-6077), due to an incomplete fix for CVE-2007-5380 (GLSA 200711-17). * Tobias Schlottke reported that the :limit and :offset parameters of ActiveRecord::Base.find() are not properly sanitized before being processed (CVE-2008-4094). * Steve from Coderrr reported that the CRSF protection in protect_from_forgery() does not parse the text/plain MIME format (CVE-2008-7248). * Nate reported a documentation error that leads to the assumption that a block returning nil passed to authenticate_or_request_with_http_digest() would deny access to the requested resource (CVE-2009-2422). * Brian Mastenbrook reported an input sanitation flaw, related to multibyte characters (CVE-2009-3009). * Gabe da Silveira reported an input sanitation flaw in the strip_tags() function (CVE-2009-4214). * Coda Hale reported an information disclosure vulnerability related to HMAC digests (CVE-2009-3086). Impact ====== A remote attacker could send specially crafted requests to a vulnerable application, possibly leading to the execution of arbitrary SQL statements or a circumvention of access control. A remote attacker could also conduct session fixation attacks to hijack a user's session or bypass the CSRF protection mechanism, or furthermore conduct Cross-Site Scripting attacks or forge a digest via multiple attempts. Workaround ========== There is no known workaround at this time. Resolution ========== All Ruby on Rails 2.3.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rails-2.3.5" All Ruby on Rails 2.2.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "=dev-ruby/rails-2.2.3-r1" NOTE: All applications using Ruby on Rails should also be configured to use the latest version available by running "rake rails:update" inside the application directory. References ========== [ 1 ] CVE-2007-5380 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5380 [ 2 ] CVE-2007-6077 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6077 [ 3 ] CVE-2008-4094 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4094 [ 4 ] CVE-2008-7248 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7248 [ 5 ] CVE-2009-2422 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2422 [ 6 ] CVE-2009-3009 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3009 [ 7 ] CVE-2009-3086 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3086 [ 8 ] CVE-2009-4214 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4214 [ 9 ] GLSA 200711-17 http://www.gentoo.org/security/en/glsa/glsa-200711-17.xml Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-200912-02.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security () gentoo org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2009 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5
Attachment:
signature.asc
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [ GLSA 200912-02 ] Ruby on Rails: Multiple vulnerabilities Alex Legler (Dec 20)