Extremely critical Ruby on Rails bug threatens more than 200,000 sites

Extremely crtical Ruby on Rails bug threatens more than 200,000 sites

arstechnica.com 09 Jan '13, 12am

Extremely critical Ruby on Rails bug threatens more than 200,000 sites

Hundreds of thousands of websites are potentially at risk following the discovery of an extremely critical vulnerability in the Ruby on Rails framework that gives remote attackers the ability to execute malicious code on the underlying servers. The bug is present in Rails versions spanning the past six years and in default configurations gives hackers a simple and reliable way to pilfer database contents, run system commands, and cause websites to crash, according to Ben Murphy, one of the developers who has confirmed the vulnerability. As of last week, the framework was used by more than 240,000 websites , including Github, Hulu, and Basecamp, underscoring the seriousness of the threat. "It is quite bad," Murphy told Ars. "An attack can send a request to any Ruby on Rails sever and then execute arbitrary commands. Even though it's complex, it's reliable, so it will work 1...

Full article: http://arstechnica.com/security/2013/01/extremely-crtical...

Tweets

@senayar_ » 07 Feb '13, 2pm
[link] oh no :O
@dangoodin001 » 01 Feb '13, 4pm
New scanner checks if your site is vulnerable to extremely critical Ruby on Rails bug https://t.co/LKjL0Vie [link]
@IanAlexan » 31 Jan '13, 5pm
Just a reminder, the rails community is dealing with two vulns that threaten almost every rails app on the internet: [link]
@CrucialApp » 26 Jan '13, 6pm
“@arstechnica: Extremely crtical Ruby on Rails bug threatens more than 200,000 sites [link] by @dangoodin001” we use laravel.
@subsisdk » 22 Jan '13, 10am
Der er blevet fundet et kritisk hul i Rails. :-( Vi anbefaler alle at opgradere nu. Læs mere her: [link]
@korfzone » 21 Jan '13, 12pm
Ja, dat is hoe je 'geüpdatet' moet schrijven. [link] De update was omwille van [link]
@Em_28 » 17 Jan '13, 2am
RT @bugblauw: it's mainstream not hipster anymore #rubyonrails [link]
@_zigi » 15 Jan '13, 10pm
Хорошая иллюстрация почему я не люблю рельсы и недоверяю компьютерам [link]
@arjunghosh » 15 Jan '13, 1am
RT @randyknob: Extremely #critical #RubyonRails bug threatens more than 200,000 sites [link] (H/T) @dangoodin001
@visualasparagus » 14 Jan '13, 1pm
Probably old news to most, but thought it best to throw it out there. #rubyonrails #updatenow, #bug [link]
@sebsto » 14 Jan '13, 11am
Web site security vulnerability affects thousands #ruby #rails #ror [link]
@candicevalero » 13 Jan '13, 2pm
Artful Dodger (@RtfulDodg3r) à Tweeté à 11:38 Extremely critical Ruby on Rails bug threatens more than 200,000 sites [link]
@123InternetAU » 12 Jan '13, 9am
"It is quite bad," Murphy told Ars. "An attack can send a request to any Ruby on Rails sever and then execute... [link]
@lindosky » 11 Jan '13, 11pm
Off the rails they go: Extremely critical Ruby on Rails bug threatens more than 200,000 sites [link]
@mariocloud » 11 Jan '13, 11pm
Extremely critical Ruby on Rails bug threatens more than 200,000 sites [link] @maumercado
@fornerdan » 11 Jan '13, 10pm
RT @danwood: Hey Ruby on Rails developers, do you know about this security flaw? [link]
@PaulCichonski » 11 Jan '13, 7pm
calling all ruby on rails users: [link]
@CalvinGroupJohn » 11 Jan '13, 6pm
Critical #Ruby on #Rails bug on the loose: [link]
@doelsengupta » 11 Jan '13, 5pm
[link] #rubyonrails
@danwood » 11 Jan '13, 4pm
Hey Ruby on Rails developers, do you know about this security flaw? [link]
@jkrebs » 11 Jan '13, 4pm
If you're using #rails, there's a critical vulnerability to fix ASAP [link] We're all patched up here @spentapi
@felipearriolab » 11 Jan '13, 1pm
RT @Tictac_SI: Un agujero en la seguridad de Ruby on Rails pone en peligro más de 200.000 sitios [link]
@Tictac_SI » 11 Jan '13, 9am
Un agujero en la seguridad de Ruby on Rails pone en peligro más de 200.000 sitios [link]
@TodoLinux » 11 Jan '13, 8am
Importante bug de seguridad en Ruby on Rails, supone grave riesgo para más de 200.000 sites: [link]
@syncup8 » 11 Jan '13, 5am
A friend pointed this out; people using Ruby on Rails should make sure they're up to date: [link]
@gparmer » 11 Jan '13, 3am
Rails vulnerability sounds harsh. [link] #security #geekitup
@SecurityMetrics » 10 Jan '13, 11pm
Hundreds of thousands of sites at risk. Remote attackers can execute malicious #code on underlying servers. [link] #hack
@ncloward » 10 Jan '13, 10pm
Interesting. Gotta research it some more. [link]
@mrpaladin » 10 Jan '13, 9pm
Very dangerous ruby bug threatens 200,000 sites #bug [link]
@bryan_inc » 10 Jan '13, 9pm
Wow. [link]
@cmykern » 10 Jan '13, 9pm
RT @devLLop: A bit of a relief not to be responsible for any of the 240K or so sites running on Rails. [link]
@xgadjitx » 10 Jan '13, 9pm
[link] Make sure your sites are up to date
@devLLop » 10 Jan '13, 9pm
A bit of a relief not to be responsible for any of the 240K or so sites running on Rails. [link]
@ibamarief » 10 Jan '13, 9pm
Extremely critical Ruby on Rails security vulnerability threatens more than 200,000 sites. [link] cc @fajrinrasyid @yulrizka
@ironictypo » 10 Jan '13, 8pm
Well, this ain't good. [link]
@bluechoochoo » 10 Jan '13, 8pm
change ur pw today, especially *less* sophisticated sites u use (pizza delivery) "critical bug threatens 200000+ sites" [link]
@kenkambona » 10 Jan '13, 7pm
If your website is running #rails, you can be HACKED. Update now. [link]
@CMSExpo » 10 Jan '13, 7pm
RT @mrpaladin: Super critical rails bug threatens 200,000 sites #rails [link]
@mrpaladin » 10 Jan '13, 7pm
Super critical rails bug threatens 200,000 sites #rails [link]
@otter311 » 10 Jan '13, 6pm
[link] Scary #ruby #rails #hack #fb
@g0dkar » 10 Jan '13, 5pm
E aih galera da Chipy... "mimimi ruby é foda mimimi java é mau mimimi" Chupa. [link]
@kennwhite » 10 Jan '13, 5pm
And so, a dynasty begins. For those just tuning in, prev post refers to one of the biggest hacks in web history: [link]
@r00t_ZerooX » 10 Jan '13, 4pm
RT @HackeaMesta: RT @mhedish: Extremely critical Ruby on Rails bug threatens more than 240,000 sites, including [link]
@HackeaMesta » 10 Jan '13, 4pm
RT @mhedish: Extremely critical Ruby on Rails bug threatens more than 240,000 sites, including [link]
@helicomatic » 10 Jan '13, 4pm
@waltz [link] Rails vulnerability, hope it doesn't hardruin your day.
@librarylettie » 10 Jan '13, 3pm
RT @KevinBGunn: “@infogena: Ugly, ugly Ruby on Rails bug #ugly [link]” #dhwi #humprog Thanks Gena!
@KevinBGunn » 10 Jan '13, 3pm
“@infogena: Ugly, ugly Ruby on Rails bug #ugly [link]” #dhwi #humprog Thanks Gena!
@srtturbo » 10 Jan '13, 2pm
RT @FOSSForce: Hundreds of thousands of websites are at risk because of a critical vulnerability in Ruby on Rails. [link]
@idtheftprotect » 10 Jan '13, 2pm
Critical Ruby on Rails bug threatens more than 200,000 websites. #hacker [link] Update right now if you use Ruby!
@infogena » 10 Jan '13, 2pm
Ugly, ugly Ruby on Rails bug #ugly [link]