Exploit Code for Ruby on Rails Flaw Likely on the Horizon

threatpost.com 09 Jan '13, 4pm

Exploit Code for Ruby on Rails Flaw Likely on the Horizon

The vulnerabilities patched Tuesday in the Ruby on Rails Web framework have security researchers warning of the potential for serious attacks and saying that one of the bugs in particular could be easy prey for attackers. The most serious of the flaws is in the parameter parsing function and could allow attackers to run arbitrary code in vulnerable apps. The team behind the Metasploit Framework is in the process of developing a module for that specific vulnerability, something that often presages the release of public exploit code for a bug. A couple of researchers have claimed publicly that they had developed proof-of-concept code that can exploit the XML parsing flaw on virtually any application built on Ruby on Rails 3.x or 2.x. HD Moore, the creator of Metasploit, said that the bug is a particularly nasty one. He said it "is more than likely the worst security issue th...

Full article: http://threatpost.com/en_us/blogs/exploit-code-ruby-rails...

Tweets

@NovanotioSec » 11 Jan '13, 1pm
Exploit Code for Ruby on Rails Flaw Likely on the Horizon: [link] #seguridad #hacking
@thijs » 10 Jan '13, 2pm
RT @flyosity: More information on the Rails XML parsing vulnerability which was weaponized early this morning. [link]
@flyosity » 10 Jan '13, 2pm
More information on the Rails XML parsing vulnerability which was weaponized early this morning. [link]
@rogeragrimes » 10 Jan '13, 11am
Info on Ruby on Rails exploit [link]
@s2grupo » 10 Jan '13, 10am
Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link] RT @Securityartwork: Exploit Code for Ruby on Rails Fl...
@oncee » 10 Jan '13, 2am
RT @suffert: Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link]
@bryan_d » 09 Jan '13, 10pm
RT @BeyondTrust: Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link] #netsec #infosec #security
@Prohest » 09 Jan '13, 10pm
RT @eEye: Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link] #netsec #infosec #security
@BeyondTrust » 09 Jan '13, 10pm
Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link] #netsec #infosec #security
@DrInfoSec » 09 Jan '13, 7pm
Exploit Code for Ruby on Rails Flaw Likely on the Horizon (by @dennisF) [link] [feat. comments by @hdmoore]
@Xuanwo4 » 09 Jan '13, 7pm
RT @PCNixToronto #toronto Exploit Code for Ruby on Rails Flaw Likely on the Horizon - [link] [link]
@cyberdad » 09 Jan '13, 6pm
#securityUpd: Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link]
@PCNixToronto » 09 Jan '13, 6pm
#toronto Exploit Code for Ruby on Rails Flaw Likely on the Horizon - [link] [link]
@Stoogie » 09 Jan '13, 5pm
Oh, Ruby Ruby, Ruby... Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link]
@CyberCrimeNEWS » 09 Jan '13, 5pm
Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link] #ccureit
@simoncrosby » 09 Jan '13, 4pm
RT @SecMash: #InfoSec Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link] #CyberSecurity
@quequero » 09 Jan '13, 4pm
RT @StopMalvertisin: Threatpost | Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link]
@thinksnews » 09 Jan '13, 4pm
Exploit Code for Ruby on Rails Flaw Likely on the Horizon: The vulnerabilities patched Tuesday in ... [link] #securitynews
@securitydigest » 09 Jan '13, 4pm
#security Exploit Code for Ruby on Rails Flaw Likely on the Horizon: The vulnerabilities patched Tuesday... [link] #online
@emzy » 09 Jan '13, 4pm
RT @DanlAMayer: RT @threatpost: Exploit Code for Ruby on Rails Flaw Likely on the Horizon - [link] < Better take this seriously...
@IT_securitynews » 09 Jan '13, 4pm
Exploit Code for Ruby on Rails Flaw Likely on the Horizon: The vulnerabilities patched Tuesday in the Ruby on Ra... [link]
@DanlAMayer » 09 Jan '13, 4pm
RT @threatpost: Exploit Code for Ruby on Rails Flaw Likely on the Horizon - [link] < Better take this seriously...
@RIPng » 09 Jan '13, 4pm
RT @threatpost: Exploit Code for Ruby on Rails Flaw Likely on the Horizon - [link]
@starkeymagazine » 09 Jan '13, 4pm
#Infosec Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link] #News
@SecMash » 09 Jan '13, 4pm
#InfoSec Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link] #CyberSecurity
@InfotechNews_ » 09 Jan '13, 4pm
Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link] [TPOST]
@threatpost » 09 Jan '13, 4pm
Exploit Code for Ruby on Rails Flaw Likely on the Horizon - [link]
@MossadBlackWolf » 09 Jan '13, 4pm
Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link]
@Insecurestuff » 09 Jan '13, 4pm
Exploit Code for Ruby on Rails Flaw Likely on the Horizon [link]
@SecurityPhresh » 09 Jan '13, 4pm
#Exploit Code For Ruby On Rails Flaw Likely On The Horizon... [link]