Vulnerability Note VU#699540

Ruby on Rails fails to properly verify input passed via the URL

Overview

Ruby on Rails fails to properly validate input. This may allow a remote attacker to execute arbitrary code on a vulnerable system.

I. Description

Ruby on Rails is a web application programming framework. Ruby on Rails 1.1.4 and earlier contain a vulnerability in the processing of user input. Rails 1.0 and earlier are not affected.

II. Impact

A remote attacker may be able to execute arbitrary code on a vulnerable system.

III. Solution

Upgrade or patch

This vulnerability has been addressed in Ruby on Rails 1.1.6.

Systems Affected

Vendor	Status	Date Notified	Date Updated
37signals	Vulnerable	10-Aug-2006
Gentoo Linux	Vulnerable	17-Aug-2006

References

http://weblog.rubyonrails.com/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits
http://secunia.com/advisories/21424/
http://secunia.com/advisories/21466/
http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure

Credit

This vulnerability was publicly reported by David August.

This document was written by Will Dormann.

Other Information

Date Public:	2006-08-09
Date First Published:	2006-08-11
Date Last Updated:	2006-09-08
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	16.45
Document Revision:	9

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2006 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader