Critical Ruby on Rails flaws fixed, upgrade immediately
Posted on 09 January 2013.
For the second week in a row since the start of the new year, users of open source web application framework Ruby on Rails are advised to upgrade to the newly offered versions immediately due to serious vulnerabilities present in previous ones.

Last week it was an SQL injection vulnerability, an exploit for which has been publicly disclosed and posed a considerable threat.

This time around the new versions contain two extremely critical security fixes for "multiple vulnerabilities in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application" (CVE-2013-0156) and for a denial-of-service vulnerability triggered when Active Record is used in conjunction with JSON parameter parsing (CVE-2013-0155).

Ben Murphy, one of the framework's developers, explained for ars technica why users should upgrade to new versions posthaste: "An attack can send a request to any Ruby on Rails sever and then execute arbitrary commands. Even though it's complex, it's reliable, so it will work 100 percent of the time."

The same set of vulnerabilities could also allow attacks to compromise sites running Rails, and then make them infect others. With over 240,000 websites currently using the framework, such an occurrence would be very bad news.

The new versions of the framework (3.2.11, 3.1.10, 3.0.19, and 2.3.15) can be downloaded at the usual locations. For those who are unable to do it, patches and workarounds are also available.


Biggest ever cyber security exercise in Europe is underway

Posted on 30 October 2014.  |  More than 200 organisations and 400 cyber-security professionals from 29 European countries are testing their readiness to counter cyber-attacks in a day-long simulation, organised by the European Network and Information Security Agency (ENISA).

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.


Thu, Oct 30th