BID:35579

Ruby on Rails 'http_authentication.rb' Nil Credentials Authentication Bypass Vulnerability

Info

Ruby on Rails 'http_authentication.rb' Nil Credentials Authentication Bypass Vulnerability

Bugtraq ID:	35579
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2009-2422
Remote:	Yes
Local:	No
Published:	Jul 06 2009 12:00AM
Updated:	Mar 29 2010 08:22PM
Credit:	Nate
Vulnerable:	Ruby on Rails Ruby on Rails 2.3.2 Gentoo Linux Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.6

Not Vulnerable:

Discussion

Ruby on Rails 'http_authentication.rb' Nil Credentials Authentication Bypass Vulnerability

Ruby on Rails is prone to an authentication-bypass vulnerability because it fails to properly enforce access restrictions on certain requests to a site that requires authentication.

An attacker can exploit this issue to gain unauthorized access to protected resources, which may lead to other attacks.

Ruby on Rails 2.3.2 is vulnerable; other versions may also be affected.

Exploit / POC

Ruby on Rails 'http_authentication.rb' Nil Credentials Authentication Bypass Vulnerability

An attacker may exploit this issue via a browser.

Solution / Fix

Ruby on Rails 'http_authentication.rb' Nil Credentials Authentication Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Apple Mac OS X 10.6