Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tokenizer and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.

Several vulnerabilities have been discovered in Rails, the Ruby web application framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-4214     A cross-site scripting (XSS) vulnerability had been     found in the strip_tags function. An attacker may inject     non-printable characters that certain browsers will then     evaluate. This vulnerability only affects the oldstable     distribution (lenny).

  - CVE-2011-2930     A SQL injection vulnerability had been found in the     quote_table_name method that could allow malicious users     to inject arbitrary SQL into a query.

  - CVE-2011-2931     A cross-site scripting (XSS) vulnerability had been     found in the strip_tags helper. An parsing error can be     exploited by an attacker, who can confuse the parser and     may inject HTML tags into the output document.

  - CVE-2011-3186     A newline (CRLF) injection vulnerability had been found     in response.rb. This vulnerability allows an attacker to     inject arbitrary HTTP headers and conduct HTTP response     splitting attacks via the Content-Type header.

Two vulnerabilities were discovered in Ruby on Rails, a web application framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3086     The cookie store may be vulnerable to a timing attack,     potentially allowing remote attackers to forge message     digests.

  - CVE-2009-4214     A cross-site scripting vulnerability in the strip_tags     function allows remote user-assisted attackers to inject     arbitrary web script.

The remote host is running a version of Mac OS X 10.6 that is older than version 10.6.3.  Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server

  - Apache

  - CoreAudio

  - CoreMedia

  - CoreTypes

  - CUPS

  - DesktopServices

  - Disk Images

  - Directory Services

  - Dovecot

  - Event Monitor

  - FreeRADIUS

  - FTP Server

  - iChat Server

  - ImageIO

  - Image RAW

  - Libsystem

  - Mail

  - MySQL

  - OS Services

  - Password Server

  - PHP

  - Podcast Producer

  - Preferences

  - PS Normalizer

  - QuickTime

  - Ruby

  - Server Admin

  - SMB

  - Tomcat

  - Wiki Server

  - X11

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.3.

Mac OS X 10.6.3 contains security fixes for the following products :

  - AFP Server
  - Apache
  - CoreAudio
  - CoreMedia
  - CoreTypes
  - CUPS
  - DesktopServices
  - Disk Images
  - Directory Services
  - Dovecot
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - ImageIO
  - Image RAW
  - Libsystem
  - Mail
  - MySQL
  - OS Services
  - Password Server
  - PHP
  - Podcast Producer
  - Preferences
  - PS Normalizer
  - QuickTime
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - Wiki Server
  - X11

This update of rubygems fixes two vulnerabilities :

  - CVE-2008-7248: CVSS v2 Base Score: 4.3 Rails CSRF     protection can be bypassed by using special     content-types for a HTTP request.

  - CVE-2009-4214: CVSS v2 Base Score: 4.3 The method     strip_tags does not completely protect against XSS     attacks.

The remote host is affected by the vulnerability described in GLSA-200912-02 (Ruby on Rails: Multiple vulnerabilities)

    The following vulnerabilities were discovered:
    sameer     reported that lib/action_controller/cgi_process.rb removes the     :cookie_only attribute from the default session options     (CVE-2007-6077), due to an incomplete fix for CVE-2007-5380 (GLSA     200711-17).
    Tobias Schlottke reported that the :limit and     :offset parameters of ActiveRecord::Base.find() are not properly     sanitized before being processed (CVE-2008-4094).
    Steve from     Coderrr reported that the CRSF protection in protect_from_forgery()     does not parse the text/plain MIME format (CVE-2008-7248).
    Nate reported a documentation error that leads to the assumption     that a block returning nil passed to     authenticate_or_request_with_http_digest() would deny access to the     requested resource (CVE-2009-2422).
    Brian Mastenbrook reported     an input sanitation flaw, related to multibyte characters     (CVE-2009-3009).
    Gabe da Silveira reported an input sanitation     flaw in the strip_tags() function (CVE-2009-4214).
    Coda Hale     reported an information disclosure vulnerability related to HMAC     digests (CVE-2009-3086).
  Impact :

    A remote attacker could send specially crafted requests to a vulnerable     application, possibly leading to the execution of arbitrary SQL     statements or a circumvention of access control. A remote attacker     could also conduct session fixation attacks to hijack a user's session     or bypass the CSRF protection mechanism, or furthermore conduct     Cross-Site Scripting attacks or forge a digest via multiple attempts.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
56074	Debian DSA-2301-2 : rails - several vulnerabilities	Nessus	Debian Local Security Checks	high
55136	Debian DSA-2260-1 : rails - several vulnerabilities	Nessus	Debian Local Security Checks	medium
5489	Mac OS X < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	critical
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
45035	openSUSE Security Update : rubygem-actionpack-2_3 (rubygem-actionpack-2_3-1934)	Nessus	SuSE Local Security Checks	medium
44983	openSUSE Security Update : rubygem-actionpack (rubygem-actionpack-1946)	Nessus	SuSE Local Security Checks	medium
44980	openSUSE Security Update : rubygem-actionpack (rubygem-actionpack-1946)	Nessus	SuSE Local Security Checks	medium
44977	openSUSE Security Update : rubygem-actionpack (rubygem-actionpack-1946)	Nessus	SuSE Local Security Checks	medium
43378	GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high

Detections

Analytics

CVE-2009-4214

medium

Tenable Plugins

high

medium

critical

critical

critical

medium

medium

medium

medium

high