FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2013-0156

This CVE name corresponds to:

Entered	Topic
2013-01-08	rubygem-rails -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2013-0156 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2013-0156
Phase	Assigned(20121206)

Description

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

References

Source	Reference
MLIST	[rubyonrails-security] 20130108 Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156)
MISC	http://www.insinuator.net/2013/01/rails-yaml/
MISC	https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
MISC	http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
CONFIRM	http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
APPLE	APPLE-SA-2013-03-14-1
DEBIAN	DSA-2604
REDHAT	RHSA-2013:0153
REDHAT	RHSA-2013:0154
REDHAT	RHSA-2013:0155
CERT-VN	VU#380039
CERT-VN	VU#628463