A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening

A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening | SecurityWeek.Com

A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening

In the case of the RoR vulnerabilities, a well hardened system would have saved the day for most RoR web applications. Many applications don’t use XML serialization at all. From those who do use it, only a minority are actually using the YAML serialization format. Therefore, the vast majority of the RoR powered applications don’t need a YAML support at all. If these systems would have been hardened to block the usage of XML, or YAML within XML, they would not have been vulnerable to CVE-2013-0156. A similar argument can be made for JSON system hardening with respect to the CVE-2013-0155 vulnerability.

Full article: http://www.securityweek.com/hard-knock-life-ruby-rails-vu...

Tweets

@Infosec_Tourist » 22 Jan '13, 11pm
RT @SecurityWeek: A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening [link] #Ruby #RoR #appsec
@whitehatsec » 22 Jan '13, 10pm
Such as the case of the #RubyonRails vulnerability, system hardening is an effective security defense– @SecurityWeek [link]
@ChadChoron » 18 Jan '13, 4am
A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening | [link] [link] via @SecurityWeek
@jennymangos » 17 Jan '13, 8pm
A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening. Technical details explained. [link]
@lance_blais » 16 Jan '13, 2pm
RT @SecMash: A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening [link] #InfoSec
@CyberExaminer » 16 Jan '13, 2pm
#cybersecurity A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening [link] #infosec
@starkeymagazine » 16 Jan '13, 2pm
#Infosec A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening [link]
@CcureIT » 16 Jan '13, 2pm
A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening [link] #ccureit
@Insecurestuff » 16 Jan '13, 2pm
A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening [link] #Insecurestuff
@SecurityPhresh » 16 Jan '13, 2pm
A Hard Knock Life - Ruby On Rails #vulnerabilities And System Hardening... [link]
@ID16899 » 16 Jan '13, 2pm
#cybersecurity A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening [link] #infosec
@SecMash » 16 Jan '13, 2pm
A Hard Knock Life - Ruby on Rails Vulnerabilities and System Hardening [link] #InfoSec
@CyberCrimeNEWS » 16 Jan '13, 2pm
A Hard Knock Life - Ruby on Rails #Vulnerabilities and System Hardening [link] #ccureit