BID:57896

Ruby on Rails CVE-2013-0276 Remote Security Bypass Vulnerability

Info

Ruby on Rails CVE-2013-0276 Remote Security Bypass Vulnerability

Bugtraq ID:	57896
Class:	Access Validation Error
CVE:	CVE-2013-0276
Remote:	Yes
Local:	No
Published:	Feb 11 2013 12:00AM
Updated:	Apr 13 2015 10:04PM
Credit:	Phenoelit, Ryan Koppenhaver
Vulnerable:	SuSE WebYaST 1.2 + S.u.S.E. Linux Personal 9.1 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 + SuSE Linux 8.1 SuSE Studio Standard Edition 1.2 SuSE Studio Onsite 1.2 SuSE Studio Extension for System z 1.2 Ruby on Rails Ruby on Rails 3.2.11 Ruby on Rails Ruby on Rails 3.2.10 Ruby on Rails Ruby on Rails 3.1.9 Ruby on Rails Ruby on Rails 3.1.8 Ruby on Rails Ruby on Rails 3.1 Ruby on Rails Ruby on Rails 2.3.16 Ruby on Rails Ruby on Rails 2.3.15 Ruby on Rails Ruby on Rails 2.3.11 Ruby on Rails Ruby on Rails 2.3.14 Ruby on Rails Ruby on Rails 2.3.13 Ruby on Rails Ruby on Rails 2.3.12 Redhat Subscription Asset Manager 1.2 Redhat Subscription Asset Manager 1.1 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Apple Mac OS X Server 10.7.5 Apple Mac OS X Server 10.7.4 Apple Mac OS X Server 10.7.3 Apple Mac OS X Server 10.7.1 Apple Mac OS X Server 10.7 Apple Mac OS X Server 10.6.8 Apple Mac OS X 10.8.2 Apple Mac OS X 10.8.1 Apple Mac OS X 10.7.5 Apple Mac OS X 10.8.3 Apple Mac OS X 10.8 Apple Mac OS X 10.7.4 Apple Mac OS X 10.7.3 Apple Mac OS X 10.7.2 Apple Mac OS X 10.7.1 Apple Mac OS X 10.7 Apple Mac OS X 10.6.8

Not Vulnerable:	Ruby on Rails Ruby on Rails 3.2.12 Ruby on Rails Ruby on Rails 3.1.11 Ruby on Rails Ruby on Rails 2.3.17 Redhat Subscription Asset Manager 1.2.1 Apple Mac OS X 10.8.4

Solution / Fix

Ruby on Rails CVE-2013-0276 Remote Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Apple Mac OS X 10.8.3

Apple OSXUpd10.8.4.dmg
For OS X Mountain Lion v10.8.3
http://www.apple.com/support/downloads/

Apple Mac OS X 10.8

Apple OSXUpdCombo10.8.4.dmg
For OS X Mountain Lion v10.8 and v10.8.2
http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.8

Apple SecUpdSrvr2013-002.dmg
For Mac OS X Server v10.6.8
http://www.apple.com/support/downloads/

Apple Mac OS X 10.7.5

Apple SecUpd2013-002.dmg
For OS X Lion v10.7.5
http://www.apple.com/support/downloads/

Apple SecUpdSrvr2013-002.dmg
For OS X Lion Server v10.7.5
http://www.apple.com/support/downloads/

Apple Mac OS X 10.8.2

Apple OSXUpdCombo10.8.4.dmg
For OS X Mountain Lion v10.8 and v10.8.2
http://www.apple.com/support/downloads/

References

Ruby on Rails CVE-2013-0276 Remote Security Bypass Vulnerability

References:

[SEC][ANN] Rails 3.2.12, 3.1.11, and 2.3.17 have been released! (Ruby on Rails)
Circumvention of attr_protected [CVE-2013-0276] (Aaron Patterson)
About the security content of OS X Mountain Lion v10.8.4 and Security Update 201 (Apple)
Moderate: Subscription Asset Manager 1.2.1 update (Red Hat)