Ruby on Rails Patches DoS, Remote Execution Flaws

threatpost.com 13 Feb '13, 6pm

Ruby on Rails Patches DoS, Remote Execution Flaws

Web app framework Ruby on Rails patched two security flaws this week in the open source framework that could have led to denial of service attacks and remote execution vulnerabilities. With builds 3.2.12, 3.1.11 and 2.3.17, the framework fixed a serialized attributes YAML vulnerability (CVE-2013-0277 ) that could have let developers give users access to the +serialize+ helper in ActiveRecord. From there an attacker could have used a specially crafted request to trick the function into deserializing arbitrary YAML data, potentially leading to remote code execution. The update also fixes another problem (CVE-2013-0276 ) in the framework’s ActiveRecord function, this one with its attr_protected method. Attackers could have bypassed the protection and alter values that were meant to be protected, according to an alert issued by Ruby on Rails contributer Aaron Patterson on Mond...

Full article: http://threatpost.com/en_us/blogs/ruby-rails-patches-dos-...

Tweets

@hyphenet » 14 Feb '13, 1am
Ruby on Rails Patches DoS, Remote Execution Flaws [link] via @threatpost #tech #security
@sboose » 14 Feb '13, 12am
RT @SecMash: Ruby on Rails Patches DoS, Remote Execution Flaws [link] #InfoSec
@mahnduck » 13 Feb '13, 9pm
[link] #rails 원격 실행 취약점이 패치가 됐네요. #vul
@Xuanwo4 » 13 Feb '13, 9pm
RT @PCNixToronto #toronto Ruby on Rails Patches DoS, Remote Execution Flaws - [link] [link]
@PCNixToronto » 13 Feb '13, 8pm
#toronto Ruby on Rails Patches DoS, Remote Execution Flaws - [link] [link]
@cyberdad » 13 Feb '13, 7pm
#securityUpd: Ruby on Rails Patches DoS, Remote Execution Flaws [link]
@GBSolution » 13 Feb '13, 7pm
Ruby on Rails Patches DoS, Remote Execution Flaws - Web app framework Ruby on Rails patched two security flaws this ... [link]
@CcureIT » 13 Feb '13, 7pm
Ruby on Rails Patches DoS, Remote Execution Flaws [link] #ccureit
@InfotechNews_ » 13 Feb '13, 7pm
#Ruby_on_Rails Patches DoS, Remote Execution Flaws [link] [TPOST]
@SnappleLlama » 13 Feb '13, 6pm
RT @threatpost: Ruby on Rails Patches DoS, Remote Execution Flaws - [link]
@RedTeamRSS » 13 Feb '13, 6pm
Ruby on Rails Patches DoS, Remote Execution Flaws: Web app framework Ruby on Rails patched two security flaws th... [link]
@SecMash » 13 Feb '13, 6pm
Ruby on Rails Patches DoS, Remote Execution Flaws [link] #InfoSec
@BWIZZ75 » 13 Feb '13, 6pm
#RubyonRails Patches DoS, Remote Execution Flaws [link] [[link]]
@MossadBlackWolf » 13 Feb '13, 6pm
Ruby on Rails Patches DoS, Remote Execution Flaws [link]
@juan_diaz_diaz » 13 Feb '13, 6pm
Ruby on Rails Patches DoS, Remote Execution Flaws: Web app framework Ruby on Rails patched two security flaws th... [link]
@Insecurestuff » 13 Feb '13, 6pm
Ruby on Rails Patches DoS, Remote Execution Flaws [link]
@SecurityHub » 13 Feb '13, 6pm
Ruby on Rails Patches DoS, Remote Execution Flaws [link]
@threatpost » 13 Feb '13, 6pm
Ruby on Rails Patches DoS, Remote Execution Flaws - [link]