Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 03 Jan 2013 13:30:52 +0100
From: Carlos Alberto Lopez Perez <clopez@...lia.com>
To: oss-security@...ts.openwall.com
CC: Aaron Patterson <tenderlove@...y-lang.org>, 
 rubyonrails-security@...glegroups.com
Subject: Re: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)

On 02/01/13 22:22, Aaron Patterson wrote:
> There is a SQL injection vulnerability in Active Record in ALL versions. This vulnerability has been assigned the CVE identifier CVE-2012-5664.


CVE-2012-5664 literally says:

"SQL injection vulnerability in the Authlogic gem for Ruby on Rails
allows remote attackers to execute arbitrary SQL commands via a crafted
parameter in conjunction with a secret_token value, related to certain
behavior of find_by_id and other find_by_ methods."


However in your description of the bug I don't see any references to the
Authlogic gem. This rather seems to be a generic RoR issue.


And both Debian and Ubuntu have marked this CVE as NOT-FOR-US because of
this (they don't ship Authlogic gem).


Could you please clarify this?


Thanks!


Download attachment "signature.asc" of type "application/pgp-signature" (901 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.