FreeBSD : rubygem-rails -- multiple vulnerabilities (ca5d3272-59e3-11e2-853b-00262d5ed8ee)

High Nessus Plugin ID 63435


The remote FreeBSD host is missing one or more security-related updates.


Ruby on Rails team reports :

Two high-risk vulnerabilities have been discovered :

(CVE-2013-0155) There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing.

Due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, it is possible for an attacker to issue unexpected database queries with 'IS NULL' or empty 'WHERE' clauses. This issue does not let an attacker insert arbitrary values into a SQL query, however they can cause the query to check for NULL or eliminate a WHERE clause when most users would not expect it.

(CVE-2013-0156) There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application.

The parameter parsing code of Ruby on Rails allows applications to automatically cast values from strings to certain data types.
Unfortunately the type casting code supported certain conversions which were not suitable for performing on user-provided data including creating Symbols and parsing YAML. These unsuitable conversions can be used by an attacker to compromise a Rails application.


Update the affected packages.

See Also

Plugin Details

Severity: High

ID: 63435

File Name: freebsd_pkg_ca5d327259e311e2853b00262d5ed8ee.nasl

Version: $Revision: 1.7 $

Type: local

Published: 2013/01/09

Modified: 2014/08/12

Dependencies: 12634

Risk Information

Risk Factor: High


Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:rubygem-actionpack, p-cpe:/a:freebsd:freebsd:rubygem-activerecord, p-cpe:/a:freebsd:freebsd:rubygem-activesupport, p-cpe:/a:freebsd:freebsd:rubygem-rails, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2013/01/08

Vulnerability Publication Date: 2013/01/08

Exploitable With

Metasploit (Ruby on Rails XML Processor YAML Deserialization Code Execution)

Reference Information

CVE: CVE-2013-0155, CVE-2013-0156