29 Jan '13, 6pm

Some Versions of Ruby on Rails Vulnerable to New Parsing Attack

A vulnerability exists in Ruby on Rails’ JavaScript Object Notation (JSON) code that could open the Web framework up to a slew of security problems. Patches were published yesterday, but if left unpatched, the vulnerability could let attackers bypass authentication systems, inject arbitrary SQL code, inject and execute arbitrary code and perform a denial of service attack on a Ruby on Rails app. The vulnerability (CVE-2013-0333) affects older versions of the framework, versions 2.3.x and 3.0.x, according to an alert sent by software developer Michael Koziarski yesterday to the Ruby on Rails security group on Google Groups. The vulnerability stems from a problem with the JSON parsing code that allows multiple parsing backends. For example, Ruby on Rails could parse YAML code, a markup format considered a superset of JSON. Since both forms of code are from the same family an...

Full article: http://threatpost.com/en_us/blogs/some-versions-ruby-rail...

Tweets

Ruby on Rails receives the third security patch in less than a month

Ruby on Rails receives the third security patch...

pcworld.com 29 Jan '13, 9pm

Developers of the Ruby on Rails Web development framework released versions 3.0.20 and 2.3.16 of the software on Monday in...

Ruby on Rails receives the third security patch...

news.techworld.com 30 Jan '13, 9am

Developers of the Ruby on Rails web development framework have released versions 3.0.20 and 2.3.16 of the software in orde...

Vulnerability in JSON Parser in Ruby on Rails 3...

groups.google.com 28 Jan '13, 9pm

Dieser Browser wird nicht unterstützt.

Vulnerability in JSON Parser in Ruby on Rails 3...

groups.google.com 28 Jan '13, 9pm

Dieser Browser wird nicht unterstützt.

Ruby on Rails receives its third security patch...

infoworld.com 29 Jan '13, 7pm

Developers of the Ruby on Rails Web development framework released versions 3.0.20 and 2.3.16 of the software on Monday in...

Top Ruby Article: XML-YAML-parsing security fix...

rubyglasses.blogspot.com 27 Jan '13, 3am

Earlier I mentioned the Serious Rails vulnerability that affects all versions of Rails for the last six years. A fix has b...

#toronto Ruby on rails receives the third secur...

news.techworld.com 30 Jan '13, 11am

Developers of the Ruby on Rails web development framework have released versions 3.0.20 and 2.3.16 of the software in orde...

Ruby on Rails receives the third security patch...

networkworld.com 30 Jan '13, 1pm

IDG News Service - Developers of the Ruby on Rails Web development framework released versions 3.0.20 and 2.3.16 of the so...

Ruby on Rails receives third security patch in ...

computerworld.com 30 Jan '13, 9am

IDG News Service - Developers of the Ruby on Rails Web development framework released versions 3.0.20 and 2.3.16 of the so...

[remote] - Ruby on Rails JSON Processor YAML De...

exploit-db.com 29 Jan '13, 3pm

## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Ple...

Ruby on Rails by ChrisAlberg

freelancer.com 04 Feb '13, 8am

love talk greater detail design project can samples work site listed please contact convenience best regards juli , thanks...

Ruby on Rails の JSON 解析処理に脆弱性

jvn.jp 29 Jan '13, 3am

Ruby on Rails [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released! Vulnerability in JSON Parser in Ruby on Rails 3.0 an...

Ruby on Rails の JSON のパラメータ解析の脆弱性により任意のコードを実行される脆弱性(CVE-2013-0333)に関する検証レポート -

Ruby on Rails の JSON のパラメータ解析の脆弱性により任意のコードを実行され...

security.intellilink.co.jp 01 Feb '13, 5am

Vulnerability Note VU#628463: Ruby on Rails 3.0 and 2.3 JSON Parser vulnerability http://www.kb.cert.org/vuls/id/628463

Come learn Ruby on Rails with me and @withloudh...

skillshare.com 30 Jan '13, 7pm

Avi Flombaum will be a TA for this course, the main material will be lectured by Robert Whitney, a Flatiron Professor Robe...