Ruby on Rails patches more critical vulnerabilities
It's the second time this month that Ruby on Rails has released updated versions for serious software flaws
IDG News Service - Those using the Ruby on Rails web application framework on their websites are being advised to update the software immediately after multiple new vulnerabilities were found. It's the second time this month that Rails has been patched because of serious flaws.
Ruby on Rails is an open-source web application development framework that is widely used across the Internet on websites including Hulu, GroupOn and Scribd.
One of the problems, CVE-2013-0156, lies in the parameter parsing code for Ruby on Rails, which would allow attackers to bypass authentication systems, perform SQL injection attacks or a denial of service attack against applications using Rails, according to an advisory on Tuesday. A SQL injection attack involves sending commands through a web-based form to a website's backend database, which, if not protected properly, can return sensitive data.
The second issue, CVE-2013-0155, would allow an attacker to send unexpected database queries with the command "IS NULL" due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, according to another writeup.
The writeup advised that this particular vulnerability is a variant of CVE-2012-2660 and CVE-2012-2694. "Even if you upgraded to address those issues, you must take action again," it said.
Four updated versions of Rails were released on Tuesday: 3.2.11, 3.1.10, 3.0.19, and 2.3.15, according to the Rails blog. "These releases contain two extremely critical security fixes so please update immediately," it advised.
It's the second time this month that Rails has been updated due to critical vulnerabilities. Rails versions 3.2.10, 3.1.9, and 3.0.18 were released on Jan. 2 to address CVE-2012-5664, a SQL injection vulnerability.
Rails apologized for releasing that patch so close to the holiday break, but said that "regrettably the exploit has already been publicly disclosed, and we don't feel we can delay the release."
Send news tips and comments to firstname.lastname@example.org. Follow me on Twitter: @jeremy_kirk
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Mobile Applications Case Study: 8 Billion Transactions a Day The story documents how the online brokerage company tradeMONSTER created a custom mobile app and the success gleaned from this initiative. Also covered...
- The Case for Mobile Apps Today's mobile apps turn handheld devices into e-book readers, portable navigation systems, digital wallets and more. And for organizations with mobile workers, they...
- Mobile Expense Management--Picking up the Money on the Ground Integrating and managing mobility expenses across multiple carriers can generate savings and improve organizational decision making.
- Partners in Mobile Device Management: AirWatch & CDW When it comes to Mobile Device Management, it's not just what you know. It's who you know. That's why CDW partners with industry...
- Live Webcast Best Practices for the Hyperconverged Enterprise Network To the Age of Constant Connectivity and Information overload
- Live Webcast Unmasking the Differences between Consumer and Enterprise File Sync & Share The consumerization of IT combined with the rapid pace of the modern mobile workplace is forcing enterprise IT teams to evaluate file sync...
- Live Webcast Government Agency Webifies Outdated COBOL Applications Let this CTO tell you how his agency converted 1980s-era green screens into an e-filing portal for the 100,000 cases handled each year...
- Mobile Apps and Devices Slash Customer Cycle Time Consolidated Engineering Laboratories' field employees used to collect data on triplicate forms that were sometimes hard to read and difficult to manage. After...
- Testimonial: Cystic Fibrosis Trust Peter Hawkins, the Head of IT for Cystic Fibrosis Trust, discusses the role CommVault's Simpana software platform plays in improving the company's information... All Applications White Papers | Webcasts