A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.

Two vulnerabilities were discovered in Ruby on Rails, a web application framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3086     The cookie store may be vulnerable to a timing attack,     potentially allowing remote attackers to forge message     digests.

  - CVE-2009-4214     A cross-site scripting vulnerability in the strip_tags     function allows remote user-assisted attackers to inject     arbitrary web script.

The remote host is affected by the vulnerability described in GLSA-200912-02 (Ruby on Rails: Multiple vulnerabilities)

    The following vulnerabilities were discovered:
    sameer     reported that lib/action_controller/cgi_process.rb removes the     :cookie_only attribute from the default session options     (CVE-2007-6077), due to an incomplete fix for CVE-2007-5380 (GLSA     200711-17).
    Tobias Schlottke reported that the :limit and     :offset parameters of ActiveRecord::Base.find() are not properly     sanitized before being processed (CVE-2008-4094).
    Steve from     Coderrr reported that the CRSF protection in protect_from_forgery()     does not parse the text/plain MIME format (CVE-2008-7248).
    Nate reported a documentation error that leads to the assumption     that a block returning nil passed to     authenticate_or_request_with_http_digest() would deny access to the     requested resource (CVE-2009-2422).
    Brian Mastenbrook reported     an input sanitation flaw, related to multibyte characters     (CVE-2009-3009).
    Gabe da Silveira reported an input sanitation     flaw in the strip_tags() function (CVE-2009-4214).
    Coda Hale     reported an information disclosure vulnerability related to HMAC     digests (CVE-2009-3086).
  Impact :

    A remote attacker could send specially crafted requests to a vulnerable     application, possibly leading to the execution of arbitrary SQL     statements or a circumvention of access control. A remote attacker     could also conduct session fixation attacks to hijack a user's session     or bypass the CSRF protection mechanism, or furthermore conduct     Cross-Site Scripting attacks or forge a digest via multiple attempts.
  Workaround :

    There is no known workaround at this time.

This update improves the escaping in the helper code of Ruby on Rails to protect against XSS attacks (CVE-2009-3009) and an information leak (CVE-2009-3086).

ID	Name	Product	Family	Severity
55136	Debian DSA-2260-1 : rails - several vulnerabilities	Nessus	Debian Local Security Checks	medium
43378	GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
42205	openSUSE Security Update : rubygem-activesupport-2_1 (rubygem-activesupport-2_1-1321)	Nessus	SuSE Local Security Checks	medium
42204	openSUSE Security Update : rubygem-actionpack-2_1 (rubygem-actionpack-2_1-1320)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2009-3086

medium

Tenable Plugins

medium

high

medium

medium