Ruby on Rails pushing out 'extremely critical' fixes

Powered by SC Magazine
 

Workaround available.

The maintainers of Ruby on Rails have pushed out the second update in a week to fix a critical hole in the framework which allows attackers to compromise applications.

The "two extremely critical security fixes" close off parameter parsing flaws present in all versions of Ruby on Rails which allows attackers to bypass authentication and execute arbitrary code in Rails apps.

"There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application," an advisory stated.

"Due to the critical nature of this vulnerability, and the fact that portions of it have been disclosed publicly, all users running an affected release should either upgrade or use one of the work-arounds immediately."

Attackers could take advantage of code that supported certain unsuitable conversions, the maintainers wrote.

"The parameter parsing code of Ruby on Rails allows applications to automatically cast values from strings to certain data types. Unfortunately the type casting code supported certain conversions which were not suitable for performing on user-provided data including creating Symbols and parsing YAML. These unsuitable conversions can be used by an attacker to compromise a Rails application."

Users could disable this conversion or XML as a workaround, but should upgrade if possible.

Popular e-commerce application Spree which uses Rails applied the fix hours ago.

But one user claims the update to Rails 3.2.11 introduces a bug in JSON parametre parsing meaning applications will stop accepting valid requests.

The update followed a fix pushed out last week for a SQL injection vulnerability located in Rails' Active Record database query interface.

Copyright © SC Magazine, Australia


Ruby on Rails pushing out 'extremely critical' fixes
 
 
 
Top Stories
Beyond ACORN: Cracking the infosec skills nut
[Blog post] Could the Government's cybercrime focus be a catalyst for change?
 
The iTnews Benchmark Awards
Meet the best of the best.
 
Telstra hands over copper, HFC in new $11bn NBN deal
Value of 2011 deal remains intact.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
Who do you trust most to protect your private data?







   |   View results
Your bank
  39%
 
Your insurance company
  3%
 
A technology company (Google, Facebook et al)
  8%
 
Your telco, ISP or utility
  7%
 
A retailer (Coles, Woolworths et al)
  2%
 
A Federal Government agency (ATO, Centrelink etc)
  20%
 
An Australian law enforcement agency (AFP, ASIO et al)
  14%
 
A State Government agency (Health dept, etc)
  6%
TOTAL VOTES: 1803

Vote
Do you support the abolition of the Office of the Information Commissioner?