Executive Summary

Summary
Title Ruby on Rails security update
Informations
Name RHSA-2013:0153 First vendor Publication 2013-01-10
Vendor RedHat Last vendor Modification 2013-01-10
Severity (Vendor) Critical Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:P/I:P/A:P)
Cvss Base Score 7.5 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Updated rubygem-actionpack, rubygem-activesupport, ruby193-rubygem-actionpack, and ruby193-rubygem-activesupport packages that fix multiple security issues are now available for Red Hat OpenShift Enterprise 1.0.

The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

2. Relevant releases/architectures:

RedHat OpenShift Enterprise Infrastructure - noarch RedHat OpenShift Enterprise Node - noarch

3. Description:

Ruby on Rails is a model–view–controller (MVC) framework for web application development. Action Pack implements the controller and the view components. Active Support provides support and utility classes used by the Ruby on Rails framework.

Multiple flaws were found in the way Ruby on Rails performed XML parameter parsing in HTTP requests. A remote attacker could use these flaws to execute arbitrary code with the privileges of a Ruby on Rails application, perform SQL injection attacks, or bypass the authentication using a specially-created HTTP request. (CVE-2013-0156)

Red Hat is aware that a public exploit for the CVE-2013-0156 issues is available that allows remote code execution in applications using Ruby on Rails.

All users of Red Hat OpenShift Enterprise are advised to upgrade to these updated packages, which correct these issues. For Red Hat OpenShift Enterprise administrators, the openshift-broker and openshift-console services must be restarted for this update to take effect. Users of OpenShift are advised to update their own applications that are running Ruby on Rails.

4. Solution:

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

5. Bugs fixed (http://bugzilla.redhat.com/):

892870 - CVE-2013-0156 rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2013-0153.html

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:19664
 
Oval ID: oval:org.mitre.oval:def:19664
Title: DSA-2604-1 rails - insufficient input validation
Description: It was discovered that Rails, the Ruby web application development framework, performed insufficient validation on input parameters, allowing unintended type conversions. An attacker may use this to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on the application.
Family: unix Class: patch
Reference(s): DSA-2604-1
CVE-2013-0156
 Version: 5
Platform(s): Debian GNU/Linux 6.0
Debian GNU/kFreeBSD 6.0
 Product(s): rails
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 160
Application 12
Os 2

SAINT Exploits

Description Link
Ruby on Rails XML Processor YAML Deserialization More info here

ExploitDB Exploits

id Description
2013-01-29 Ruby on Rails JSON Processor YAML Deserialization Code Execution
2013-01-10 Ruby on Rails XML Processor YAML Deserialization Code Execution

Snort® IPS/IDS

Date Description
2014-01-10 Rails XML parameter parsing vulnerability exploitation attempt
RuleID : 25288 - Revision : 10 - Type : SERVER-OTHER
2014-01-10 Rails XML parameter parsing vulnerability exploitation attempt
RuleID : 25287 - Revision : 12 - Type : SERVER-OTHER

Nessus® Vulnerability Scanner

Date Description
2015-03-26 Name : The remote Debian host is missing a security update.
File : debian_DLA-172.nasl - Type : ACT_GATHER_INFO
2014-12-15 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201412-28.nasl - Type : ACT_GATHER_INFO
2014-06-13 Name : The remote openSUSE host is missing a security update.
File : openSUSE-2013-106.nasl - Type : ACT_GATHER_INFO
2013-03-15 Name : The remote host is missing a Mac OS X update that fixes several security issues.
File : macosx_SecUpd2013-001.nasl - Type : ACT_GATHER_INFO
2013-03-14 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_cda566a02df04eb0b70eed7a6fb0ab3c.nasl - Type : ACT_GATHER_INFO
2013-02-05 Name : The remote host is missing an update for OS X Server that fixes two security ...
File : macosx_server_2_2_1.nasl - Type : ACT_GATHER_INFO
2013-01-24 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2013-0154.nasl - Type : ACT_GATHER_INFO
2013-01-23 Name : The remote Fedora host is missing one or more security updates.
File : fedora_2013-0635.nasl - Type : ACT_GATHER_INFO
2013-01-23 Name : The remote Fedora host is missing one or more security updates.
File : fedora_2013-0686.nasl - Type : ACT_GATHER_INFO
2013-01-21 Name : The remote Fedora host is missing one or more security updates.
File : fedora_2013-0568.nasl - Type : ACT_GATHER_INFO
2013-01-10 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-2604.nasl - Type : ACT_GATHER_INFO
2013-01-09 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_ca5d327259e311e2853b00262d5ed8ee.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
1
2
3
Date Informations
2013-01-30 21:19:55
  • Multiple Updates
2013-01-14 21:20:58
  • Multiple Updates
2013-01-14 13:20:34
  • Multiple Updates
2013-01-11 00:17:41
  • First insertion