Multiple cross-site scripting (XSS) vulnerabilities in the mail_to helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.

The remote host is affected by the vulnerability described in GLSA-201412-28 (Ruby on Rails: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Ruby on Rails. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code or cause a Denial of       Service condition. Furthermore, a remote attacker may be able to execute       arbitrary SQL commands, change parameter names for form inputs and make       changes to arbitrary records in the system, bypass intended access       restrictions, render arbitrary views, inject arbitrary web script or       HTML, or conduct cross-site request forgery (CSRF) attacks.
  Workaround :

    There is no known workaround at this time.

This update of rails fixes the following security issues :

CVE-2011-2930 - SQL-injection in quote_table_name function via specially crafted column names (bnc#712062) CVE-2011-2931 - Cross-Site Scripting (XSS) in the strip_tags helper (bnc#712057) CVE-2011-3186 - Response Splitting (bnc#712058) CVE-2010-3933 - Arbitrary modification of records via specially crafted form parameters (bnc#712058) CVE-2011-0446 - Cross-Site Scripting (XSS) in the mail_to helper (bnc#668817) CVE-2011-0447 - Improper validation of 'X-Requested-With' header (bnc#668817) CVE-2011-0448 - SQL-injection caused by improperly sanitized arguments to the limit function (bnc#668817) CVE-2011-0449 - Bypass of access restrictions via specially crafted action names (bnc#668817)

Several vulnerabilities have been discovered in Rails, the Ruby web application framework. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2011-0446     Multiple cross-site scripting (XSS) vulnerabilities when     JavaScript encoding is used, allow remote attackers to     inject arbitrary web script or HTML.

  - CVE-2011-0447     Rails does not properly validate HTTP requests that     contain an X-Requested-With header, which makes it     easier for remote attackers to conduct cross-site     request forgery (CSRF) attacks.

Update to the Rails 3.0.5

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fixes (CVE-2011-0446, CVE-2011-0447).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
79981	GLSA-201412-28 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
76016	openSUSE Security Update : rubygem-actionmailer (openSUSE-SU-2011:1305-1)	Nessus	SuSE Local Security Checks	high
75730	openSUSE Security Update : rubygem-actionmailer (openSUSE-SU-2011:1305-1)	Nessus	SuSE Local Security Checks	high
55035	Debian DSA-2247-1 : rails - several vulnerabilities	Nessus	Debian Local Security Checks	medium
53299	Fedora 15 : rubygem-actionmailer-3.0.5-1.fc15 / rubygem-actionpack-3.0.5-1.fc15 / etc (2011-4358)	Nessus	Fedora Local Security Checks	high
52557	Fedora 13 : rubygem-actionpack-2.3.5-4.fc13 (2011-2138)	Nessus	Fedora Local Security Checks	medium
52556	Fedora 14 : rubygem-actionpack-2.3.8-3.fc14 (2011-2133)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-0446

medium

Tenable Plugins

critical

high

high

medium

high

medium

medium