Security Vulnerability in Ruby on Rails 1.1.x
- From: michael@xxxxxxxxxxxxx
- Date: 11 Aug 2006 02:50:48 -0000
Product: Ruby on Rails
Affected: 1.1.0, 1.1.1, 1.1.2, 1.1.4, 1.1.5
Problem Description
-------------------
Scott Barron and Tobias Luetke, of the Ruby on Rails Core Team, discovered a fault with the dependency resolution mechanism which can, when exploited by a remote attacker, leave a system vulnerable to denial of service attacks, or even data loss.
All users of affected releases are advised to upgrade, or apply the relevant patches immediately.
URL: http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure
Patches
-------
1.1.0: http://www.rubyonrails.org/files/aug_10_security/rel_1-1-0.diff
1.1.1: http://www.rubyonrails.org/files/aug_10_security/rel_1-1-1.diff
1.1.2: http://www.rubyonrails.org/files/aug_10_security/rel_1-1-2.diff
1.1.4: http://www.rubyonrails.org/files/aug_10_security/rel_1-1-4.diff
1.1.5 users should upgrade to 1.1.6.
- Prev by Date: Re: linksys WRT54g authentication bypass
- Next by Date: [security bulletin] HPSBUX02108 SSRT061133 rev.14 - HP-UX Running Sendmail, Remote Execution of Arbitrary Code
- Previous by thread: XSSing the Lan 3 (web trojans.. not a new idea)
- Next by thread: [security bulletin] HPSBUX02108 SSRT061133 rev.14 - HP-UX Running Sendmail, Remote Execution of Arbitrary Code
- Index(es):
Relevant Pages
|
Loading
