lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

An updated rubygem-activesupport package that fixes one security issue is now available for Red Hat OpenShift Enterprise 1.0.

The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Ruby on Rails is a model-view-controller (MVC) framework for web application development. Active Support provides support and utility classes used by the Ruby on Rails framework.

A flaw was found in the way Active Support performed the parsing of JSON requests by translating them to YAML. A remote attacker could use this flaw to execute arbitrary code with the privileges of a Ruby on Rails application, perform SQL injection attacks, or bypass the authentication using a specially-created JSON request. (CVE-2013-0333)

Red Hat would like to thank Ruby on Rails upstream for reporting this issue. Upstream acknowledges Lawrence Pit of Mirror42 as the original reporter.

All users of Red Hat OpenShift Enterprise are advised to upgrade to this updated package, which resolves this issue. For Red Hat OpenShift Enterprise administrators, the openshift-broker and openshift-console services must be restarted for this update to take effect. Users of OpenShift are advised to update their own applications that are running Ruby on Rails.

The remote host is affected by the vulnerability described in GLSA-201412-28 (Ruby on Rails: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Ruby on Rails. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could execute arbitrary code or cause a Denial of       Service condition. Furthermore, a remote attacker may be able to execute       arbitrary SQL commands, change parameter names for form inputs and make       changes to arbitrary records in the system, bypass intended access       restrictions, render arbitrary views, inject arbitrary web script or       HTML, or conduct cross-site request forgery (CSRF) attacks.
  Workaround :

    There is no known workaround at this time.

This update updates the RubyOnRails 2.3 stack to 2.3.16, also this update updates the RubyOnRails 3.2 stack to 3.2.11.

Security and bugfixes were done, foremost: CVE-2013-0333: A JSON sql/code injection problem was fixed. CVE-2012-5664: A SQL Injection Vulnerability in Active Record was fixed. CVE-2012-2695: A SQL injection via nested hashes in conditions was fixed. CVE-2013-0155:
Unsafe Query Generation Risk in Ruby on Rails was fixed.
CVE-2013-0156: Multiple vulnerabilities in parameter parsing in Action Pack were fixed.

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-002 applied.  This update contains numerous security-related fixes for the following components :

  - CoreMedia Playback (10.7 only)
  - Directory Service (10.6 only)
  - OpenSSL
  - QuickDraw Manager
  - QuickTime
  - Ruby (10.6 only)
  - SMB (10.7 only)

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-001 applied.  This update contains numerous security-related fixes for the following components :

  - Apache
  - CoreTypes (10.7 only)
  - International Components for Unicode
  - Identity Services (10.7 only)
  - ImageIO
  - Messages Server (Server only)
  - PDFKit
  - Podcast Producer Server (Server only)
  - PostgreSQL (Server only)
  - Profile Manager (10.7 Server only)
  - QuickTime
  - Ruby (10.6 Server only)
  - Security
  - Software Update
  - Wiki Server (10.7 Server only)

Note that the update also runs a malware removal tool that will remove the most common variants of malware.

Fixes CVE-2013-0333.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Mac OS X 10.8 host has a version of OS X Server installed that is prior to 2.2.1. It is, therefore, affected by the following vulnerabilities :

  - A type casting issue exists in Ruby on Rails due to     improper handling of XML parameters. A remote attacker     can exploit this issue to execute arbitrary code through     either the Profile Manager or Wiki Server components.
    (CVE-2013-0156)

  - A type casting issue exists in Ruby on Rails due to     improper handling of JSON data. A remote attacker can     exploit this to execute arbitrary code through the     Wiki Server component. (CVE-2013-0333)

Lawrence Pit discovered that Ruby on Rails, a web development framework, is vulnerable to a flaw in the parsing of JSON to YAML.
Using a specially crafted payload attackers can trick the backend into decoding a subset of YAML.

The vulnerability has been addressed by removing the YAML backend and adding the OkJson backend.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2013:0201 advisory.

    Ruby on Rails is a modelviewcontroller (MVC) framework for web     application development. Active Support provides support and utility     classes used by the Ruby on Rails framework.

    A flaw was found in the way Active Support performed the parsing of JSON     requests by translating them to YAML. A remote attacker could use this flaw     to execute arbitrary code with the privileges of a Ruby on Rails     application, perform SQL injection attacks, or bypass the authentication     using a specially-created JSON request. (CVE-2013-0333)

    Red Hat would like to thank Ruby on Rails upstream for reporting this     issue. Upstream acknowledges Lawrence Pit of Mirror42 as the original     reporter.

    Users of Red Hat Subscription Asset Manager are advised to upgrade to this     updated package, which resolves this issue. Katello must be restarted     (service katello restart) for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
119430	RHEL 6 : rubygem-activesupport (RHSA-2013:0202)	Nessus	Red Hat Local Security Checks	high
79981	GLSA-201412-28 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
74881	openSUSE Security Update : ruby (openSUSE-SU-2013:0278-1)	Nessus	SuSE Local Security Checks	high
66809	Mac OS X Multiple Vulnerabilities (Security Update 2013-002)	Nessus	MacOS X Local Security Checks	critical
65578	Mac OS X Multiple Vulnerabilities (Security Update 2013-001)	Nessus	MacOS X Local Security Checks	high
64542	Fedora 16 : rubygem-activesupport-3.0.10-6.fc16 (2013-1745)	Nessus	Fedora Local Security Checks	high
64540	Fedora 17 : rubygem-activesupport-3.0.11-8.fc17 (2013-1710)	Nessus	Fedora Local Security Checks	high
64476	Mac OS X : OS X Server < 2.2.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
64364	Debian DSA-2613-1 : rails - insufficient input validation	Nessus	Debian Local Security Checks	high
64281	RHEL 6 : rubygem-activesupport (RHSA-2013:0201)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2013-0333

critical

Tenable Plugins

high

critical

high

critical

high

high

high

high

high

critical