Ruby on Rails has SQL injection vuln

The maintainers of Ruby on Rails are warning of an SQL injection vulnerability which affects all versions of the popular Web framework. They advise that users should immediately apply an upgrade available here . Designated CVE-2012-5664, the maintainers explain the bug this way: “Due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope. Carefully crafted requests can use the scope to inject arbitrary SQL.” New versions have been released to eliminate the flaw, and the Ruby on Rails team also describes a workaround (for careful users who want to test the new versions before implementation). “The issue can be mitigated by explicitly converting the parameter to an expected value,” the post explains. As noted by Threatpost, Phenoelit has a more detailed explanation of the impact of the bug here...

Full article: http://www.theregister.co.uk/2013/01/03/ruby_on_rails_sql...

Tweets

@CSLU1 » 28 Jan '13, 11am
RT @MonochromeUK: Ruby on Rails has SQL injection vuln [link]
@netsecured99 » 13 Jan '13, 3am
RT @Canaudit2013Ruby on Rails has SQL injection #vuln ~ [link] ~ [[link]]: Ruby on Rails has SQL injectio...
@netsecured99 » 08 Jan '13, 9am
RT @vinnyq122013Can happen on any framework. Ruby on Rails has SQL injection vuln [link] via: Can happen on any framewo...
@vinnyq12 » 08 Jan '13, 9am
Can happen on any framework. Ruby on Rails has SQL injection vuln [link] via
@shai_saint » 08 Jan '13, 2am
RT @jennymangos: Ruby on Rails are warning of an SQL injection vulnerability which affects all versions of the popular Web framework [link]
@jennymangos » 07 Jan '13, 10pm
Ruby on Rails are warning of an SQL injection vulnerability which affects all versions of the popular Web framework [link]
@NRG_fx » 06 Jan '13, 10am
SQL injection vulnerability on ALL Ruby on Rails versions #security #privacy #cloud [link]
@pogao » 05 Jan '13, 10am
SQL Injection no Ruby on Rails: [link]
@charleymelia » 05 Jan '13, 9am
The maintainers of Ruby on Rails are warning of an SQL injection vulnerability which affects all versions. [link]
@maraauraauwie » 05 Jan '13, 6am
Might be of use Sir @abcidee RT @OxbloodRuffin Ruby on Rails has SQL injection vuln [link] …
@netsecured99 » 04 Jan '13, 6pm
RT @PeterMAbraham2013Ruby on Rails has SQL injection vuln [link] #security #infosec #itsec: Ruby on Rails has SQL injec...
@PeterMAbraham » 04 Jan '13, 5pm
Ruby on Rails has SQL injection vuln [link] #security #infosec #itsec
@deepITthoughts » 04 Jan '13, 4pm
RT @aaronhurt: Ruby on Rails has SQL injection vulnerability [link]
@alberror » 04 Jan '13, 2pm
Vulnérabilité aux injections SQL dans Ruby on Rails. [link]
@beregueder » 04 Jan '13, 2pm
RT @ContextSec: Ruby on Rails has SQL injection vuln [link] #infosec #pcidss #glba #ei3pa #hipaa #ruby
@ContextSec » 04 Jan '13, 2pm
Ruby on Rails has SQL injection vuln [link] #infosec #pcidss #glba #ei3pa #hipaa #ruby
@SecurityInfomt » 04 Jan '13, 11am
News Ruby on Rails has SQL injection vuln (The Register): [link] @SecurityInfomt
@1Anndra » 04 Jan '13, 10am
#SecNewsFeed Ruby on Rails has SQL injection vuln (The Register): [link]
@b0rn2Frag » 04 Jan '13, 10am
Ruby on Rails has SQL injection vuln (The Register): [link] #ISC
@Onboard_IT » 04 Jan '13, 8am
I just read 'Ruby on Rails has SQL injection vuln' on The Register - [link]
@dascritch » 04 Jan '13, 7am
2013, le premier trou serveur est pour ruby on rails [link] année pleine de surprises, alors
@joneszach » 04 Jan '13, 7am
“@OxbloodRuffin: Ruby on Rails has SQL injection vuln [link]” linkbait super bullshit article
@pjaway » 04 Jan '13, 7am
RT @theregister: Ruby on Rails has SQL injection vuln: Get patching. The maintainers of Ruby on Rails are warning of an SQL injection… [link]
@mndell » 04 Jan '13, 7am
Probleem met RoR: Op jacht naar railsapp/config/initializers/secret_token.rb - Ruby on Rails has SQL injection vuln [link]
@Sec_Cyber » 04 Jan '13, 7am
Ruby on Rails has SQL injection vuln [link] #sqlinjection
@F_ZG » 04 Jan '13, 6am
CC @fahchen RT @OxbloodRuffin: Ruby on Rails has SQL injection vuln [link]
@Netw0rkSecurity » 04 Jan '13, 5am
#OWASP Ruby on Rails has SQL injection vuln â€¢ The Register - The maintainers of Ruby on Rails are warning of ... [link]
@Netw0rkSecurity » 04 Jan '13, 5am
#OWASP Ruby on Rails has SQL injection vuln - The maintainers of Ruby on Rails are warning of an SQL injection vuln ... [link]
@netsecured99 » 04 Jan '13, 4am
RT @CyberExaminer2013#cybersecurity Ruby on Rails has SQL injection vuln [link] #infosec: #cybersecurity Ruby on Rails ...
@CyberExaminer » 04 Jan '13, 4am
#cybersecurity Ruby on Rails has SQL injection vuln [link] #infosec
@EduardoLasso » 04 Jan '13, 3am
RT @OxbloodRuffin: Ruby on Rails has SQL injection vuln [link]
@LevvitronLabs » 04 Jan '13, 2am
Ruby On Rails Has SQL Injection Vulnerability: [link] via @Levvitron
@b0rn70d13 » 04 Jan '13, 2am
#News ≈ Packet Sto Ruby On Rails Has SQL Injection Vulnerability: [link]
@sentinelCS » 04 Jan '13, 2am
Sentinel Auto Feed Ruby On Rails Has SQL Injection Vulnerability: [link]
@Xc0resecurity » 04 Jan '13, 2am
#xc0resecurity Ruby On Rails Has SQL Injection Vulnerability: [link] #infosec #netsec
@EdgarUlloa » 04 Jan '13, 2am
"@opexxx: Ruby On Rails Has SQL Injection #Vulnerability: [link]"
@Blackhatleaks » 03 Jan '13, 11pm
[link] - Ruby on Rails has SQL injection vuln: Get patching The maintainers of Ruby on Rails ar... [link] seo
@lynngr » 03 Jan '13, 11pm
RT @ElReg: Ruby on Rails has SQL injection vuln: Get patching The maintainers of Ruby on Rails are warning of an SQL inject... [link]
@devilx » 03 Jan '13, 10pm
Oh noes, #Ruby on #Rails is vulnerable for SQL injections in all its versions: [link]
@Eldoctorbugs » 03 Jan '13, 10pm
#anonymous Ruby on Rails has SQL injection vuln: Get patching The maintainers of Ruby on Rails are warni... [link] #hacker
@BWIZZ75 » 03 Jan '13, 10pm
[[link]] Ruby on Rails has SQL injection vuln: Get patching The maintainers of Ruby on Rails are wa... [link]
@thinksnews » 03 Jan '13, 10pm
Ruby on Rails has SQL injection vuln: Get patching The maintainers of Ruby on Rails are warni... [link] #infosec #security
@cyberdefence » 03 Jan '13, 10pm
Ruby on Rails has SQL injection vuln: Get patching The maintainers of Ruby on Rails are warning of an S... [link] #infosec
@RavtachSolution » 03 Jan '13, 10pm
Ruby on Rails has SQL injection vuln: Get patching The maintainers of Ruby on Rails are warning of... [link] #arcavir asia
@jamesmears » 03 Jan '13, 10pm
RT @regvulture: Ruby on Rails has SQL injection vuln: Get patching. The maintainers of Ruby on Rails are warning of an SQL injection… [link]
@juancarlosmt » 03 Jan '13, 10pm
Ruby on Rails has SQL injection vulnerability [link] [link]
@Dizzyeek » 03 Jan '13, 10pm
Ruby on Rails has SQL injection vuln Get patching The maintainers of Ruby on Rails are warning of an SQL injection v... [link]
@yraze » 03 Jan '13, 10pm
via @regvulture Ruby on Rails has SQL injection vuln [link] #latest #technews
@rssnest » 03 Jan '13, 10pm
£1,033.00g £18.70s [link] Ruby on Rails has SQL injection vuln
@ashtergroup » 03 Jan '13, 10pm
#register #news #IT Ruby on Rails has SQL injection vuln: Get patching The maintainers of Ruby ... [link] #tech #world #US