SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.

The remote Red Hat Enterprise Linux CoreOS 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0220 advisory.

  - Origin: rhc-chk.rb password exposure in log files (CVE-2012-5658)

  - Jenkins: HTTP response splitting (CVE-2012-6072)

  - Jenkins: open redirect (CVE-2012-6073)

  - Jenkins: cross-site scripting vulnerability (CVE-2012-6074)

  - rubygem-activerecord: find_by_* SQL Injection (CVE-2012-6496)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before
    3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted
    request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data
    types in certain find_by_ method calls. (CVE-2012-6496)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2013:0220 advisory.

    Red Hat OpenShift Enterprise is a cloud computing Platform-as-a-Service     (PaaS) solution designed for on-premise or private cloud deployments.

    Refer to the Red Hat OpenShift Enterprise 1.1 Release Notes for information     about the changes in this release. The Release Notes will be available     shortly from https://access.redhat.com/knowledge/docs/

    This update also fixes the following security issues:

    It was found that the master cryptographic key of Jenkins could be     retrieved via the HTTP server that is hosting Jenkins. A remote attacker     could use this flaw to access the server and execute arbitrary code with     the privileges of the user running Jenkins. Note that this issue only     affected Jenkins instances that had slaves attached and that also allowed     anonymous read access (not the default configuration). Manual action is     also required to correct this issue. Refer to Jenkins Security Advisory     2013-01-04, linked to in the References, for further information.
    (CVE-2013-0158)

    When the rhc-chk script was run in debug mode, its output included     sensitive information, such as database passwords, in plain text. As this     script is commonly used when troubleshooting, this flaw could lead to users     unintentionally exposing sensitive information in support channels (for     example, a Bugzilla report). This update removes the rhc-chk script.
    (CVE-2012-5658)

    Multiple flaws in the Jenkins web interface could allow a remote attacker     to perform HTTP response splitting and cross-site scripting (XSS) attacks,     as well as redirecting a victim to an arbitrary page by utilizing an open     redirect flaw. (CVE-2012-6072, CVE-2012-6074, CVE-2012-6073)

    A flaw was found in the way rubygem-activerecord dynamic finders extracted     options from method parameters. A remote attacker could possibly use this     flaw to perform SQL injection attacks against applications using the Active     Record dynamic finder methods. (CVE-2012-6496)

    The openshift-port-proxy-cfg program created a temporary file in an     insecure way. A local attacker could use this flaw to perform a symbolic     link attack, overwriting an arbitrary file accessible to the root user with     a 0 or a 1, which could lead to a denial of service. By default,     OpenShift uses polyinstantiation (per user) for the /tmp/ directory,     minimizing the risk of exploitation by local attackers. (CVE-2013-0164)

    The CVE-2013-0164 issue was discovered by Michael Scherer of the Red Hat     Regional IT team.

    Users of Red Hat OpenShift Enterprise 1.0 are advised to upgrade to Red Hat     OpenShift Enterprise 1.1.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update updates the RubyOnRails 2.3 stack to 2.3.16, also this update updates the RubyOnRails 3.2 stack to 3.2.11.

Security and bugfixes were done, foremost: CVE-2013-0333: A JSON sql/code injection problem was fixed. CVE-2012-5664: A SQL Injection Vulnerability in Active Record was fixed. CVE-2012-2695: A SQL injection via nested hashes in conditions was fixed. CVE-2013-0155:
Unsafe Query Generation Risk in Ruby on Rails was fixed.
CVE-2013-0156: Multiple vulnerabilities in parameter parsing in Action Pack were fixed.

The remote host is affected by the vulnerability described in GLSA-201401-22 (Active Record: SQL injection)

    An Active Record method parameter can mistakenly be used as a scope.
  Impact :

    A remote attacker could use specially crafted input to execute arbitrary       SQL statements.
  Workaround :

    The vulnerability may be mitigated by converting the input to an       expected value. This is accomplished by changing instances of       &lsquo;Post.find_by_id(params[:id])&rsquo; in code using Active Record to       &lsquo;Post.find_by_id(params[:id].to_s)&rsquo;

Red Hat Subscription Asset Manager 1.2, which fixes several security issues, multiple bugs, and adds various enhancements, is now available.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Red Hat Subscription Asset Manager acts as a proxy for handling subscription information and software updates on client machines.

It was discovered that Katello did not properly check user permissions when handling certain requests. An authenticated remote attacker could use this flaw to download consumer certificates or change settings of other users' systems if they knew the target system's UUID.
(CVE-2012-5603)

A vulnerability in rubygem-ldap_fluff allowed a remote attacker to bypass authentication and log into Subscription Asset Manager when a Microsoft Active Directory server was used as the back-end authentication server. (CVE-2012-5604)

It was found that the '/usr/share/katello/script/katello-generate-passphrase' utility, which is run during the installation and configuration process, set world-readable permissions on the '/etc/katello/secure/passphrase' file. A local attacker could use this flaw to obtain the passphrase for Katello, giving them access to information they would otherwise not have access to. (CVE-2012-5561)

Note: After installing this update, ensure the '/etc/katello/secure/passphrase' file is owned by the root user and group and mode 0750 permissions. Sites should also consider re-creating the Katello passphrase as this issue exposed it to local users.

Three flaws were found in rubygem-rack. A remote attacker could use these flaws to perform a denial of service attack against applications using rubygem-rack. (CVE-2012-6109, CVE-2013-0183, CVE-2013-0184)

A flaw was found in the way rubygem-activerecord dynamic finders extracted options from method parameters. A remote attacker could possibly use this flaw to perform SQL injection attacks against applications using the Active Record dynamic finder methods.
(CVE-2012-6496)

It was found that ruby_parser from rubygem-ruby_parser created a temporary file in an insecure way. A local attacker could use this flaw to perform a symbolic link attack, overwriting arbitrary files accessible to the application using ruby_parser. (CVE-2013-0162)

The CVE-2012-5603 issue was discovered by Lukas Zapletal of Red Hat;
CVE-2012-5604 was discovered by Og Maciel of Red Hat; CVE-2012-5561 was discovered by Aaron Weitekamp of the Red Hat Cloud Quality Engineering team; and CVE-2013-0162 was discovered by Michael Scherer of the Red Hat Regional IT team.

These updated Subscription Asset Manager packages include a number of bug fixes and enhancements. Space precludes documenting all of these changes in this advisory. Refer to the Red Hat Subscription Asset Manager 1.2 Release Notes for information about these changes :

https://access.redhat.com/knowledge/docs/en-US/ Red_Hat_Subscription_Asset_Manager/1.2/html/Release_Notes/index.html

All users of Red Hat Subscription Asset Manager are advised to upgrade to these updated packages, which fix these issues and add various enhancements.

Updated rubygem-actionpack, rubygem-activesupport, and rubygem-activerecord packages that fix multiple security issues are now available for Red Hat Subscription Asset Manager.

The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components. Active Record implements object-relational mapping for accessing database entries using objects. Active Support provides support and utility classes used by the Ruby on Rails framework.

Multiple flaws were found in the way Ruby on Rails performed XML parameter parsing in HTTP requests. A remote attacker could use these flaws to execute arbitrary code with the privileges of a Ruby on Rails application, perform SQL injection attacks, or bypass the authentication using a specially-created HTTP request. (CVE-2013-0156)

Red Hat is aware that a public exploit for the CVE-2013-0156 issues is available that allows remote code execution in applications using Ruby on Rails.

Multiple input validation vulnerabilities were discovered in rubygem-activerecord. A remote attacker could possibly use these flaws to perform a SQL injection attack against an application using rubygem-activerecord. (CVE-2012-2661, CVE-2012-2695, CVE-2012-6496, CVE-2013-0155)

Multiple input validation vulnerabilities were discovered in rubygem-actionpack. A remote attacker could possibly use these flaws to perform a SQL injection attack against an application using rubygem-actionpack and rubygem-activerecord. (CVE-2012-2660, CVE-2012-2694)

Multiple cross-site scripting (XSS) flaws were found in rubygem-actionpack. A remote attacker could use these flaws to conduct XSS attacks against users of an application using rubygem-actionpack.
(CVE-2012-3463, CVE-2012-3464, CVE-2012-3465)

A flaw was found in the HTTP digest authentication implementation in rubygem-actionpack. A remote attacker could use this flaw to cause a denial of service of an application using rubygem-actionpack and digest authentication. (CVE-2012-3424)

Users are advised to upgrade to these updated rubygem-actionpack, rubygem-activesupport, and rubygem-activerecord packages, which resolve these issues. Katello must be restarted ('service katello restart') for this update to take effect.

Fix for CVE-2012-6496.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ruby on Rails team reports :

There is a SQL injection vulnerability in Active Record in ALL versions. Due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope. Carefully crafted requests can use the scope to inject arbitrary SQL.

joernchen of Phenoelit discovered that rails, an MVC ruby based framework geared for web application development, is not properly treating user-supplied input to 'find_by_*' methods. Depending on how the ruby on rails application is using these methods, this allows an attacker to perform SQL injection attacks, e.g., to bypass authentication if Authlogic is used and the session secret token is known.

ID	Name	Product	Family	Type	Severity
312025	RHCOS 6 : Red Hat OpenShift Enterprise 1.1 update (Important) (RHSA-2013:0220)	Nessus	Red Hat Local Security Checks	Local	medium
421854	SCA: security update for activerecord (GHSA-gh2w-j7cx-2664)	Tenable Cloud Security	SCA Checks	Local	critical
421854	SCA: security update for activerecord (GHSA-gh2w-j7cx-2664)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
119431	RHEL 6 : Red Hat OpenShift Enterprise 1.1 update (Important) (RHSA-2013:0220)	Nessus	Red Hat Local Security Checks	Local	low
74881	openSUSE Security Update : ruby (openSUSE-SU-2013:0278-1)	Nessus	SuSE Local Security Checks	Local	high
72077	GLSA-201401-22 : Active Record: SQL injection	Nessus	Gentoo Local Security Checks	Local	high
65172	RHEL 6 : Subscription Asset Manager (RHSA-2013:0544)	Nessus	Red Hat Local Security Checks	Local	high
64076	RHEL 6 : Ruby on Rails in Subscription Asset Manager (RHSA-2013:0154)	Nessus	Red Hat Local Security Checks	Local	high
63531	Fedora 17 : rubygem-activerecord-3.0.11-4.fc17 (2013-0245)	Nessus	Fedora Local Security Checks	Local	high
63530	Fedora 16 : rubygem-activerecord-3.0.10-4.fc16 (2013-0244)	Nessus	Fedora Local Security Checks	Local	high
63527	Fedora 18 : rubygem-activerecord-3.2.8-2.fc18 (2013-0185)	Nessus	Fedora Local Security Checks	Local	high
63434	FreeBSD : rubygem-rails -- SQL injection vulnerability (b4051b52-58fa-11e2-853b-00262d5ed8ee)	Nessus	FreeBSD Local Security Checks	Local	high
63382	Debian DSA-2597-1 : rails - input validation error	Nessus	Debian Local Security Checks	Local	high

Detections

Analytics

CVE-2012-6496

critical

Tenable Plugins

medium

critical

critical

low

high

high

high

high

high

high

high

high

high