Ruby on Rails derails 240,000 sites with enormo security hole

Ruby off the Rails: Enormo security hole puts 240k sites at risk

Ruby on Rails derails 240,000 sites with enormo security hole

Popular programming framework Ruby on Rails is affected by two critical security vulnerabilities - one allowing anyone to execute commands on the servers running affected web apps. The bugs both involve the parsing and handling of data supplied by visitors to a Rails application. The CVE-2013-0156 hole is the more severe of the two because it allows remote-code execution against any Ruby on Rails application that has the XML parser enabled - a feature switched on by default. According to security tools firm Sourcefire the flaw allows hackers to run system commands on the server with the same level of privileges as the app. Both vulnerabilities can be resolved by updating to the latest version of the Ruby on Rails platform. But what makes the holes particularly nasty is that, until the patches are applied, every application running on the insecure open-source framework will...

Full article: http://www.theregister.co.uk/2013/01/10/ruby_on_rails_sec...

Comments

@BrianBuchalter

11 Jan '13, 12pm
Most coverage of this issue doesn't cover both mitigation strategies and verifying you've closed the vulnerability. I wrote <a href="http://blog.endpoint.com/2013/01/rails-CVE-2013-0156-metasploit.html">Use to Metasploit to Verify Rails is Secured from CVE-2013-0156</a> to cover both these important bases.
- See on: Twitter

Tweets

@Sylvinho81 » 14 Jan '13, 7am
Ruby off the Rails: Enormo security hole puts 240k sites at risk [link] vía @regvulture
@olsgreen » 12 Jan '13, 8pm
Ruby off the Rails: Enormo security hole puts 240k sites at risk [link] #rails #webdevelopment #coding
@PeterMAbraham » 11 Jan '13, 5pm
Ruby off the Rails: Enormo security hole puts 240k sites at risk [link] #security #infosec #itsec
@DotNetClubUC3M » 11 Jan '13, 9am
RT @aitorTheRed: Importante agujero de seguridad de Ruby on Rails [link] ¡Actualizad o morid! (y no es coña)
@jjcremades » 11 Jan '13, 9am
Ruby off the Rails: fallo de seguridad muy gordo que afecta a todas las apps [link] via @regvulture @AndresJCremades
@aitorTheRed » 11 Jan '13, 9am
Importante agujero de seguridad de Ruby on Rails [link] ¡Actualizad o morid! (y no es coña)
@xala3pa » 11 Jan '13, 9am
Más agujeros de seguirad, ahora le toca su turno a Ruby on Rails, a esto se referían los Mayas? - [link]
@erramun » 11 Jan '13, 9am
RT @javahispano: Ruby off the Rails: fallo de seguridad muy gordo que afecta a todas las apps; si tienes una mira esto [link]
@javahispano » 11 Jan '13, 9am
Ruby off the Rails: fallo de seguridad muy gordo que afecta a todas las apps; si tienes una mira esto [link]
@pyxze » 11 Jan '13, 5am
Ruby on Rails derails 240,000 sites with enormo security hole [link] via @prismatic
@SecurityInfomt » 11 Jan '13, 1am
News Ruby on Rails derails 240,000 sites with enormo security hole (The Register): [link] @SecurityInfomt
@1Anndra » 11 Jan '13, 1am
#SecNewsFeed Ruby on Rails derails 240,000 sites with enormo security hole (The Register): [link]
@b0rn2Frag » 11 Jan '13, 1am
Ruby on Rails derails 240,000 sites with enormo security hole (The Register): [link] #ISC
@GarrettCobarr » 10 Jan '13, 10pm
RT @PogoWasRight: Ruby off the Rails: Enormo security hole puts 240k sites at risk: Update NOW [link] #n
@PogoWasRight » 10 Jan '13, 10pm
Ruby off the Rails: Enormo security hole puts 240k sites at risk: Update NOW [link] #n
@_Pa5caL_ » 10 Jan '13, 10pm
Ruby off the Rails: Update NOW or give everyone shell access to your app server #RoR #infosec [link]
@AlexanderJN » 10 Jan '13, 10pm
RT @opexxx: Ruby off the Rails: Enormo security hole puts 240k sites at risk: Update NOW or give everyone shell access to yo... [link]
@providesecurity » 10 Jan '13, 10pm
Ruby off the Rails: Enormo security hole puts 240k sites at risk: Update NOW or give everyone shell acces... [link] #owasp
@nipungupta » 10 Jan '13, 9pm
RT @fcerullo: I just read 'Ruby off the Rails: Enormo security hole puts 240k sites at risk' on The Register - [link]
@fcerullo » 10 Jan '13, 9pm
I just read 'Ruby off the Rails: Enormo security hole puts 240k sites at risk' on The Register - [link]
@yraze » 10 Jan '13, 8pm
via @regvulture Ruby off the Rails: Enormo security hole puts 240k sites at risk [link] #latest #technews
@easiserv » 10 Jan '13, 7pm
Hmmm, beware: Ruby off the Rails: Enormo security hole puts 240k sites at risk [link] via @regvulture
@vxroot » 10 Jan '13, 6pm
RT @CoreSecurity: Ruby #off the Rails: Large security hole puts 240k sites at risk via @regvulture [link]
@CoreSecurity » 10 Jan '13, 6pm
Ruby #off the Rails: Large security hole puts 240k sites at risk via @regvulture [link]
@ckmaresca » 10 Jan '13, 6pm
If you use Ruby on Rails you need to patch it NOW! [link] An exxploit giving shell access just published [link]
@Jim_Alcock » 10 Jan '13, 5pm
Ooops! RT @theregister: Ruby on Rails derails 240,000 sites with enormo security hole: [link]
@robertauger » 10 Jan '13, 4pm
RT @michaelmcg19: wow, ruby on rails #fail 2013 [link]
@s_horsfield » 10 Jan '13, 4pm
RT @cybfor: Ruby on Rails derails 240,000 sites with enormo security hole: [[link]] Update NOW or give everyone... [link]
@Blackhatleaks » 10 Jan '13, 4pm
[link] - Ruby off the Rails: Enormo security hole puts 240k sites at risk: Update NOW or give e... [link] seo
@mayurm_whitehat » 10 Jan '13, 4pm
RT @OWASP_feed: Ruby on Rails derails 240,000 sites with enormo security hole: Update NOW or give everyone shell ... [link] #OWASP #AppSec
@mtmcgrew » 10 Jan '13, 4pm
wow, ruby on rails #fail 2013 [link]
@Rajigreenwitch » 10 Jan '13, 4pm
RT @OpPinkPower: RT @lilithlela: Ruby on Rails derails 240,000 sites with enormo security hole #security [link] [link]
@AliciaBroadest » 10 Jan '13, 4pm
RT @ElReg: Ruby off the Rails: Enormo security hole puts 240k sites at risk: Update NOW or give everyone shell access to yo... [link]
@security_links » 10 Jan '13, 4pm
Ruby on Rails derails 240,000 sites with enormo security hole [link] via @zite
@ashtergroup » 10 Jan '13, 4pm
#register #news #IT Ruby off the Rails: Enormo security hole puts 240k sites at risk: Update NO... [link] #tech #world #US
@elreglatest » 10 Jan '13, 4pm
Ruby off the Rails: Enormo security hole puts 240k sites at risk: Update NOW or give e... [link] [link] (FB)
@ElReg » 10 Jan '13, 4pm
Ruby off the Rails: Enormo security hole puts 240k sites at risk: Update NOW or give everyone shell access to yo... [link]
@miklosbagi » 10 Jan '13, 4pm
Ruby off the Rails: Enormo security hole puts 240k sites at risk • The Register [link]
@TechL0G » 10 Jan '13, 4pm
Ruby off the Rails: Enormo security hole puts 240k sites at risk: Update NOW or give ever... [link] | [link]
@rubiredblue » 10 Jan '13, 4pm
Ruby off the Rails: Enormo security hole puts 240k sites at risk [link] > Silly Ruby!
@OpPinkPower » 10 Jan '13, 4pm
RT @lilithlela: Ruby on Rails derails 240,000 sites with enormo security hole #security [link] [link]
@TechKnowledgeIt » 10 Jan '13, 4pm
Ruby on Rails derails 240,000 sites with enormo security hole [link] #tki
@dan_lopez » 10 Jan '13, 3pm
Ruby on Rails derails 240,000 sites with enormo security hole [link] #railsfails
@RavtachSolution » 10 Jan '13, 3pm
Ruby on Rails derails 240,000 sites with enormo security hole: Update NOW or give everyone shell a... [link] #arcavir asia
@Serena » 10 Jan '13, 3pm
RT @Anonymos_Spain: #anonymous Ruby on Rails derails 240,000 sites with enormo security hole: Update NOW or give everyone sh... [link] #hacker
@RavtachSolution » 10 Jan '13, 3pm
Ruby on Rails derails 240,000 sites with enormo security hole [link] arcavir#
@IEEEGreen » 10 Jan '13, 3pm
Ruby on Rails derails 240,000 sites with enormo security hole [link] #IEEE #IEEEGreen
@OWASP_feed » 10 Jan '13, 3pm
Ruby on Rails derails 240,000 sites with enormo security hole: Update NOW or give everyone shell ... [link] #OWASP #AppSec
@mandyhassall » 10 Jan '13, 3pm
Ruby on Rails derails 240,000 sites with enormo security hole [link] via @regvulture @Rapid7
@rssnest » 10 Jan '13, 3pm
£1,040.50g £19.06s [link] Ruby on Rails derails 240,000 sites with enormo security hole

Ruby off the Rails: Enormo security hole puts 240k sites at risk