Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.3.  Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server

  - Apache

  - CoreAudio

  - CoreMedia

  - CoreTypes

  - CUPS

  - DesktopServices

  - Disk Images

  - Directory Services

  - Dovecot

  - Event Monitor

  - FreeRADIUS

  - FTP Server

  - iChat Server

  - ImageIO

  - Image RAW

  - Libsystem

  - Mail

  - MySQL

  - OS Services

  - Password Server

  - PHP

  - Podcast Producer

  - Preferences

  - PS Normalizer

  - QuickTime

  - Ruby

  - Server Admin

  - SMB

  - Tomcat

  - Wiki Server

  - X11

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

Brian Mastenbrook discovered that rails, the MVC ruby based framework geared for web application development, is prone to cross-site scripting attacks via malformed strings in the form helper.

The remote host is affected by the vulnerability described in GLSA-200912-02 (Ruby on Rails: Multiple vulnerabilities)

    The following vulnerabilities were discovered:
    sameer     reported that lib/action_controller/cgi_process.rb removes the     :cookie_only attribute from the default session options     (CVE-2007-6077), due to an incomplete fix for CVE-2007-5380 (GLSA     200711-17).
    Tobias Schlottke reported that the :limit and     :offset parameters of ActiveRecord::Base.find() are not properly     sanitized before being processed (CVE-2008-4094).
    Steve from     Coderrr reported that the CRSF protection in protect_from_forgery()     does not parse the text/plain MIME format (CVE-2008-7248).
    Nate reported a documentation error that leads to the assumption     that a block returning nil passed to     authenticate_or_request_with_http_digest() would deny access to the     requested resource (CVE-2009-2422).
    Brian Mastenbrook reported     an input sanitation flaw, related to multibyte characters     (CVE-2009-3009).
    Gabe da Silveira reported an input sanitation     flaw in the strip_tags() function (CVE-2009-4214).
    Coda Hale     reported an information disclosure vulnerability related to HMAC     digests (CVE-2009-3086).
  Impact :

    A remote attacker could send specially crafted requests to a vulnerable     application, possibly leading to the execution of arbitrary SQL     statements or a circumvention of access control. A remote attacker     could also conduct session fixation attacks to hijack a user's session     or bypass the CSRF protection mechanism, or furthermore conduct     Cross-Site Scripting attacks or forge a digest via multiple attempts.
  Workaround :

    There is no known workaround at this time.

This update improves the escaping in the helper code of Ruby on Rails to protect against XSS attacks (CVE-2009-3009) and an information leak (CVE-2009-3086).

- Fixes CVE-2009-3009 - Downgrade to Rails 2.3.2 to avoid     update issues for existing applications

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability is found on Ruby on Rails in the escaping code for the form helpers, which also affects the rpms shipped in Fedora Project.
Attackers who can inject deliberately malformed unicode strings into the form helpers can defeat the escaping checks and inject arbitrary HTML. This issue has been tagged as CVE-2009-3009. These new rpms will fix this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
5489	Mac OS X < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	critical
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
44752	Debian DSA-1887-1 : rails - missing input sanitising	Nessus	Debian Local Security Checks	medium
43378	GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
42205	openSUSE Security Update : rubygem-activesupport-2_1 (rubygem-activesupport-2_1-1321)	Nessus	SuSE Local Security Checks	medium
42204	openSUSE Security Update : rubygem-actionpack-2_1 (rubygem-actionpack-2_1-1320)	Nessus	SuSE Local Security Checks	medium
42128	Fedora 11 : rubygem-actionmailer-2.3.2-3.fc11 / rubygem-actionpack-2.3.2-2.fc11 / etc (2009-10484)	Nessus	Fedora Local Security Checks	medium
41634	Fedora 11 : rubygem-actionpack-2.3.3-2.fc11 / rubygem-activesupport-2.3.3-2.fc11 (2009-9922)	Nessus	Fedora Local Security Checks	medium
41612	Fedora 10 : rubygem-actionpack-2.1.1-3.fc10 / rubygem-activesupport-2.1.1-2.fc10 (2009-9799)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2009-3009

medium

Tenable Plugins

critical

critical

critical

medium

high

medium

medium

medium

medium

medium