Ruby on Rails CVE-2013-0156 Multiple Security Vulnerabilities

Bugtraq ID:	57187
Class:	Input Validation Error
CVE:	CVE-2013-0156
Remote:	Yes
Local:	No
Published:	Jan 08 2013 12:00AM
Updated:	Apr 13 2015 09:29PM
Credit:	Ben Murphy, Magnus Holm, Felix Wilhelm, Darcy Laycock, Jonathan Rudenberg, Bryan Helmkamp, Benoist Claassen and Charlie Somerville
Vulnerable:	Tableau Software Tableau Server 6.1.11 Tableau Software Tableau Server 7.0.12 SuSE WebYaST 1.2 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 + SuSE Linux 8.1 SuSE Studio Standard Edition 1.2 SuSE Studio Onsite 1.2 SuSE Studio Extension for System z 1.2 SuSE Cloud 1.0 S.u.S.E. openSUSE 12.2 S.u.S.E. openSUSE 12.1 S.u.S.E. openSUSE 11.4 Ruby on Rails Ruby on Rails 3.2.10 Ruby on Rails Ruby on Rails 3.2.8 Ruby on Rails Ruby on Rails 3.2.7 Ruby on Rails Ruby on Rails 3.2.6 Ruby on Rails Ruby on Rails 3.2.4 Ruby on Rails Ruby on Rails 3.2.2 Ruby on Rails Ruby on Rails 3.1.9 Ruby on Rails Ruby on Rails 3.1.8 Ruby on Rails Ruby on Rails 3.1.7 Ruby on Rails Ruby on Rails 3.1.6 Ruby on Rails Ruby on Rails 3.1.5 Ruby on Rails Ruby on Rails 3.1.4 Ruby on Rails Ruby on Rails 3.1.2 Ruby on Rails Ruby on Rails 3.0.18 Ruby on Rails Ruby on Rails 3.0.17 Ruby on Rails Ruby on Rails 3.0.16 Ruby on Rails Ruby on Rails 3.0.14 Ruby on Rails Ruby on Rails 3.0.13 Ruby on Rails Ruby on Rails 3.0.12 Ruby on Rails Ruby on Rails 3.0.11 Ruby on Rails Ruby on Rails 3.0.1 Ruby on Rails Ruby on Rails 2.3.11 Ruby on Rails Ruby on Rails 2.3.10 Ruby on Rails Ruby on Rails 3.0.10 Ruby on Rails Ruby on Rails 2.3.14 Ruby on Rails Ruby on Rails 2.3.13 Ruby on Rails Ruby on Rails 2.3.12 Invensys Wonderware Intelligence Software 1.5 SP1 Infoblox NetMRI 6.5.3 Infoblox NetMRI 6.5.2 Infoblox NetMRI 6.5.1 IBM Security Network Intrusion Prevention System 4.5 IBM Security Network Intrusion Prevention System 4.4 IBM Security Network Intrusion Prevention System 4.3 IBM Security Network Intrusion Prevention System 4.2 IBM Security Network Intrusion Prevention System 4.1 Gentoo Linux Fujitsu Systemwalker Resource Coordinator for Windows 13.3 Fujitsu ServerView Resource Orchestrator Virtual Edition for Windows 3.1.1 Fujitsu ServerView Resource Orchestrator Virtual Edition for Windows 3.1 Fujitsu ServerView Resource Orchestrator Virtual Edition for Linux 3.1.1 Fujitsu ServerView Resource Orchestrator Virtual Edition for Linux 3.1 Fujitsu ServerView Resource Orchestrator Virtual Edition for Linux 3.0 Fujitsu ServerView Resource Orchestrator for Windows 2.2.2 Fujitsu ServerView Resource Orchestrator for Windows 2.2.1 Fujitsu ServerView Resource Orchestrator for Windows 2.2 Fujitsu ServerView Resource Orchestrator for Linux 2.2.2 Fujitsu ServerView Resource Orchestrator for Linux 2.2.1 Fujitsu ServerView Resource Orchestrator for Linux 2.2 Fujitsu ServerView Resource Orchestrator Express for Windows 3.1.1 Fujitsu ServerView Resource Orchestrator Express for Windows 3.1 Fujitsu ServerView Resource Orchestrator Express for Linux 3.1.1 Fujitsu ServerView Resource Orchestrator Express for Linux 3.1 Fujitsu ServerView Resource Orchestrator Cloud Edition for Windows 3.1.1 Fujitsu ServerView Resource Orchestrator Cloud Edition for Windows 3.1 Fujitsu ServerView Resource Orchestrator Cloud Edition for Linux 3.1.1 Fujitsu ServerView Resource Orchestrator Cloud Edition for Linux 3.1 Fujitsu ServerView Resource Orchestrator Cloud Edition for Linux 3.0 Fujitsu ServerView Resource Coordinator VE Standard for Windows 2.2.2 Fujitsu ServerView Resource Coordinator VE Standard for Windows 2.2 Fujitsu ServerView Resource Coordinator VE Standard for Windows 2.1.3 Fujitsu ServerView Resource Coordinator VE Standard for Windows 2.1.2 Fujitsu ServerView Resource Coordinator VE Standard for Windows 2.1 Fujitsu ServerView Resource Coordinator VE Standard for Linux 2.2.2 Fujitsu ServerView Resource Coordinator VE Standard for Linux 2.2 Fujitsu ServerView Resource Coordinator VE Standard for Linux 2.1.3 Fujitsu ServerView Resource Coordinator VE Standard for Linux 2.1.2 Fujitsu ServerView Resource Coordinator VE Standard for Linux 2.1.1 Fujitsu ServerView Resource Coordinator VE Enterprise for Windows 2.2.2 Fujitsu ServerView Resource Coordinator VE Enterprise for Windows 2.2 Fujitsu ServerView Resource Coordinator VE Enterprise for Windows 2.1.3 Fujitsu ServerView Resource Coordinator VE Enterprise for Windows 2.1.2 Fujitsu ServerView Resource Coordinator VE Enterprise for Windows 2.1 Fujitsu ServerView Resource Coordinator VE Enterprise for Linux 2.2.2 Fujitsu ServerView Resource Coordinator VE Enterprise for Linux 2.2 Fujitsu ServerView Resource Coordinator VE Enterprise for Linux 2.1.3 Fujitsu ServerView Resource Coordinator VE Enterprise for Linux 2.1.2 Fujitsu ServerView Resource Coordinator VE Enterprise for Linux 2.1.1 Fujitsu ServerView Resource Coordinator VE Compact for Windows 2.2.2 Fujitsu ServerView Resource Coordinator VE Compact for Windows 2.2 Fujitsu ServerView Resource Coordinator VE Compact for Windows 2.1.3 Fujitsu ServerView Resource Coordinator VE Compact for Windows 2.1.2 Fujitsu ServerView Resource Coordinator VE Compact for Windows 2.1 Fujitsu ServerView Resource Coordinator VE Compact for Linux 2.2.2 Fujitsu ServerView Resource Coordinator VE Compact for Linux 2.2 Fujitsu ServerView Resource Coordinator VE Compact for Linux 2.1.3 Fujitsu ServerView Resource Coordinator VE Compact for Linux 2.1.2 Fujitsu ServerView Resource Coordinator VE Compact for Linux 2.1.1 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Apple Mac OS X Server 10.7.5 Apple Mac OS X Server 2.1.1 Apple Mac OS X Server 2.1 Apple Mac OS X Server 10.7.4 Apple Mac OS X Server 10.7.3 Apple Mac OS X Server 10.7.2 Apple Mac OS X Server 10.7.1 Apple Mac OS X Server 10.7 Apple Mac OS X Server 10.6.8 Apple Mac OS X 10.8
Not Vulnerable:	Tableau Software Tableau Server 6.1.12 Ruby on Rails Ruby on Rails 3.2.11 Ruby on Rails Ruby on Rails 3.1 Ruby on Rails Ruby on Rails 3.0.19 Ruby on Rails Ruby on Rails 2.3.15 Apple Mac OS X Server 2.2.1 Apple Mac OS X 10.8.3

Ruby on Rails CVE-2013-0156 Multiple Security Vulnerabilities

Ruby on Rails is prone to multiple security vulnerabilities because it fails to properly sanitize user-supplied input. These vulnerabilities include a security-bypass vulnerability, an SQL-injection vulnerability, a denial-of service vulnerability, and an arbitrary code execution vulnerability.

An attacker can exploit these vulnerabilities to bypass certain security restrictions, execute arbitrary code in the context of the affected application, exploit latent vulnerabilities in the underlying database, deny service to legitimate users, or perform unauthorized actions. Other attacks are also possible.

These issues are fixes in:

Ruby on Rails 2.3.15
Ruby on Rails 3.0.19
Ruby on Rails 3.1.10
Ruby on Rails 3.2.11

Ruby on Rails CVE-2013-0156 Multiple Security Vulnerabilities

Attackers can exploit these issues through a browser. To exploit the cross-site scripting issue, an attacker must entice an unsuspecting user into following a malicious URI.

The following exploits are available:

• /data/vulnerabilities/exploits/57187.rb
• /data/vulnerabilities/exploits/57187-1.rb
• /data/vulnerabilities/exploits/57187-2.rb
• /data/vulnerabilities/exploits/57187-3.rb
• /data/vulnerabilities/exploits/57187-4.rb
• /data/vulnerabilities/exploits/57187-5.rb

Ruby on Rails CVE-2013-0156 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Ruby on Rails CVE-2013-0156 Multiple Security Vulnerabilities

References:

• Ruby on Rails Home Page (Ruby on Rails)
  
• Ruby on Rails Vulnerabililty (Tableau Software)
  
• SUSE-SU-2013:0508-1: important: Security update for rubygem-merb-core (SUSE)
  
• Vulnerability in NetMRI 6.5.x (CVE-2013-0156) (Infoblox)
  
• About the security content of OS X Mountain Lion v10.8.3 and Security Update 201 (Apple)
  
• APPLE-SA-2013-02-04-1: OS X Server v2.2.1 (Apple)
  
• Fujitsu Multiple Products Ruby on Rails security vulnarability(CVE-2013-0156). (Fujitsu)
  
• Security Bulletin: IBM Security Network Intrusion Prevention System can be affec (IBM)
  
• VU#380039: Ruby on Rails contains multiple vulnerabilities in parameter parsing (US-CERT)
  
• WONDERWARE INTELLIGENCE TABLEAU SERVER RUBY ON RAILS IMPROPER INPUT VALIDATION (CERT)