Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.

This update fixes the following security issues with rubygem-actionpack-3_2 :

  - fix CVE-2013-4389: rubygem-actionmailer-3_1: possible     DoS vulnerability in the log subscriber component     (bnc#846239) File CVE-2013-4389.patch contains the fix.

  - fix CVE-2013-4491: rubygem-actionpack: i18n missing     translation XSS (bnc#853625). File CVE-2013-4491.patch     contains the patch

  - fix CVE-2013-6414: rubygem-actionpack: Action View DoS     (bnc#853633). File CVE-2013-6414.patch contains the     patch.

  - fix CVE-2013-6415: rubygem-actionpack:
    number_to_currency XSS (bnc#853632). File     CVE-2013-6415.patch contains the patch.

  - fix CVE-2013-6417: rubygem-actionpack: unsafe query     generation risk (incomplete fix for CVE-2013-0155)     (bnc#853627). File CVE-2013-6417.patch contains the     patch.

This update fixes the following security issue with rubygem-actionmailer-3_2 :

  - fix CVE-2013-4389: rubygem-actionmailer-3_1: possible     DoS vulnerability in the log subscriber component     (bnc#846239) File CVE-2013-4389.patch contains the fix.

This update fixes the following security issues with rubygem-activesupport-3_2 :

  - fix CVE-2013-4389: rubygem-actionmailer-3_1: possible     DoS vulnerability in the log subscriber component     (bnc#846239) File CVE-2013-4389.patch contains the fix.

Toby Hsieh, Peter McLarnan, Ankit Gupta, Sudhir Rao and Kevin Reintjes discovered multiple cross-site scripting and denial of service vulnerabilities in Ruby Actionpack.

Aaron Neyer discovered that missing input sanitising in the logging component of Ruby Actionmailer could result in denial of service through a malformed e-mail message.

Avoid potential format string vulnerabilities where user-provided data is interpolated into the log message before String#% is called.
(CVE-2013-4389).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
75284	openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0009-1)	Nessus	SuSE Local Security Checks	medium
74864	openSUSE Security Update : rubygem-actionmailer-3_2 (openSUSE-SU-2013:1928-1)	Nessus	SuSE Local Security Checks	medium
74863	openSUSE Security Update : rubygem-activesupport-3_2 (openSUSE-SU-2013:1931-1)	Nessus	SuSE Local Security Checks	medium
73239	Debian DSA-2888-1 : ruby-actionpack-3.2 - security update	Nessus	Debian Local Security Checks	medium
73238	Debian DSA-2887-1 : ruby-actionmailer-3.2 - security update	Nessus	Debian Local Security Checks	medium
72123	Fedora 19 : rubygem-actionmailer-3.2.13-2.fc19 / rubygem-actionpack-3.2.13-4.fc19 / etc (2014-0970)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4389

high

Tenable Plugins

medium

medium

medium

medium

medium

medium