Ruby on Rails CVE-2014-0082 Denial of Service Vulnerability

Bugtraq ID:	65604
Class:	Unknown
CVE:	CVE-2014-0082
Remote:	Yes
Local:	No
Published:	Feb 18 2014 12:00AM
Updated:	Apr 13 2015 09:44PM
Credit:	Toby Hsieh
Vulnerable:	SuSE Studio Onsite 1.3 S.u.S.E. openSUSE 13.1 S.u.S.E. openSUSE 12.3 Ruby on Rails Ruby on Rails 3.2.13 Ruby on Rails Ruby on Rails 3.2.12 Ruby on Rails Ruby on Rails 3.2.11 Ruby on Rails Ruby on Rails 3.2.10 Ruby on Rails Ruby on Rails 3.2.8 Ruby on Rails Ruby on Rails 3.2.7 Ruby on Rails Ruby on Rails 3.2.6 Ruby on Rails Ruby on Rails 3.2.4 Ruby on Rails Ruby on Rails 3.2.2 Ruby on Rails Ruby on Rails 3.1.12 Ruby on Rails Ruby on Rails 3.1.11 Ruby on Rails Ruby on Rails 3.1.9 Ruby on Rails Ruby on Rails 3.1.8 Ruby on Rails Ruby on Rails 3.1.7 Ruby on Rails Ruby on Rails 3.1.6 Ruby on Rails Ruby on Rails 3.1.5 Ruby on Rails Ruby on Rails 3.1.4 Ruby on Rails Ruby on Rails 3.1.2 Ruby on Rails Ruby on Rails 3.1 Ruby on Rails Ruby on Rails 3.0.20 Ruby on Rails Ruby on Rails 3.0.19 Ruby on Rails Ruby on Rails 3.0.18 Ruby on Rails Ruby on Rails 3.0.17 Ruby on Rails Ruby on Rails 3.0.16 Ruby on Rails Ruby on Rails 3.0.14 Ruby on Rails Ruby on Rails 3.0.13 Ruby on Rails Ruby on Rails 3.0.12 Ruby on Rails Ruby on Rails 3.0.11 Ruby on Rails Ruby on Rails 3.0.6 Ruby on Rails Ruby on Rails 3.0.5 Ruby on Rails Ruby on Rails 3.0.4 Ruby on Rails Ruby on Rails 3.0.3 Ruby on Rails Ruby on Rails 3.0.2 Ruby on Rails Ruby on Rails 3.0.1 Ruby on Rails Ruby on Rails 3.0 Ruby on Rails Ruby on Rails 3.2.16 Ruby on Rails Ruby on Rails 3.2.15 Ruby on Rails Ruby on Rails 3.2 Ruby on Rails Ruby on Rails 3.1.0.rc6 Ruby on Rails Ruby on Rails 3.1.0.rc5 Ruby on Rails Ruby on Rails 3.0.8 Ruby on Rails Ruby on Rails 3.0.7 Ruby on Rails Ruby on Rails 3.0.10 Redhat Software Collections for RHEL 0 Redhat CloudForms 3.0 Puppetlabs Puppet Enterprise 3.1.3 Puppetlabs Puppet Enterprise 3.1.2 Puppetlabs Puppet Enterprise 3.1 Puppetlabs Puppet Enterprise 3.0.1 Puppetlabs Puppet Enterprise 3.0 Puppetlabs Puppet Enterprise 2.8.3 Puppetlabs Puppet Enterprise 2.8.2 Puppetlabs Puppet Enterprise 2.7.2 Puppetlabs Puppet Enterprise 2.7.1 Puppetlabs Puppet Enterprise 2.7 Puppetlabs Puppet Enterprise 2.5.2 Puppetlabs Puppet Enterprise 2.5.1 Puppetlabs Puppet Enterprise 2.0.3 Puppetlabs Puppet Enterprise 2.0.2 Puppetlabs Puppet Enterprise 1.2.7 Puppetlabs Puppet Enterprise 3.1.1 Puppetlabs Puppet Enterprise 3.0 Puppetlabs Puppet Enterprise 2.8.4 Puppetlabs Puppet Enterprise 2.8.0 Puppetlabs Puppet Enterprise 2.6 Puppetlabs Puppet Enterprise 1.2 Puppetlabs Puppet Enterprise 1.1 Puppetlabs Puppet Enterprise 1.0 Puppetlabs Puppet Enterprise 2.0 OPSCODE Chef 11.1.2 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6
Not Vulnerable:	Ruby on Rails Ruby on Rails 3.2.17 Puppetlabs Puppet Enterprise 3.2 OPSCODE Chef 11.1.3

Ruby on Rails CVE-2014-0082 Denial of Service Vulnerability

Ruby on Rails is prone to a denial-of-service vulnerability.

Exploiting this issue allows remote attackers to trigger denial-of-service conditions due to excessive CPU consumption.

Ruby on Rails CVE-2014-0082 Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information

Ruby on Rails CVE-2014-0082 Denial of Service Vulnerability

References:

• Chef Server Heartbleed (CVE-2014-0160) Releases (Chef Software)
  
• CVE-2014-0082 (ActionView vulnerability in Ruby on Rails) (Puppet Labs)
  
• Enterprise Chef 11.1.3 Release (Chef Software)
  
• Release Notes - 3.2.17, 4.0.3 and 4.1.0 beta2 (Ruby on Rails)
  
• Ruby on Rails HomePage (Ruby on Rails)
  
• ruby193-rubygem-actionpack security update (Red Hat)
  
• Security Advisory Critical: cfme security, bug fix, and enhancement update (Red Hat)
  
• Security update for SUSE Studio (Suse)