what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2013-0154-01

Posted Jan 11, 2013

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2013-0154-01 - Ruby on Rails is a model-view-controller framework for web application development. Action Pack implements the controller and the view components. Active Record implements object-relational mapping for accessing database entries using objects. Active Support provides support and utility classes used by the Ruby on Rails framework. Multiple flaws were found in the way Ruby on Rails performed XML parameter parsing in HTTP requests. A remote attacker could use these flaws to execute arbitrary code with the privileges of a Ruby on Rails application, perform SQL injection attacks, or bypass the authentication using a specially-created HTTP request.

tags | advisory, remote, web, arbitrary, sql injection, ruby

systems | linux, redhat

advisories | CVE-2012-2660, CVE-2012-2661, CVE-2012-2694, CVE-2012-2695, CVE-2012-3424, CVE-2012-3463, CVE-2012-3464, CVE-2012-3465, CVE-2012-6496, CVE-2013-0155, CVE-2013-0156

SHA-256 | b89415f26cbe7df0292f8becc9d6c5ea880a07ca0ff91d3ddedb27ea9643cf93

Download | Favorite | View

Related Files

No related files