ID de Prueba:	1.3.6.1.4.1.25623.1.0.802050
Categoría:	Web application abuses
Título:	Ruby on Rails XML Processor YAML Deserialization RCE Vulnerability
Resumen:	Ruby on Rails is prone to a remote command execution (RCE); vulnerability.
Descripción:	Summary: Ruby on Rails is prone to a remote command execution (RCE) vulnerability. Vulnerability Insight: Flaw is due to an error when parsing XML parameters, which allows symbol and yaml types to be a part of the request and can be exploited to execute arbitrary commands. Vulnerability Impact: Successful exploitation could allow attackers to execute arbitrary commands. Affected Software/OS: Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11. Solution: Upgrade to Ruby on Rails 2.3.15, 3.0.19, 3.1.10, 3.2.11, or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2013-0156 APPLE-SA-2013-03-14-1 http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html DSA-2604 http://www.debian.org/security/2013/dsa-2604 RHSA-2013:0153 http://rhn.redhat.com/errata/RHSA-2013-0153.html RHSA-2013:0154 http://rhn.redhat.com/errata/RHSA-2013-0154.html RHSA-2013:0155 http://rhn.redhat.com/errata/RHSA-2013-0155.html VU#380039 http://www.kb.cert.org/vuls/id/380039 VU#628463 http://www.kb.cert.org/vuls/id/628463 [rubyonrails-security] 20130108 Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156) https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/ http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html http://www.insinuator.net/2013/01/rails-yaml/ https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156 https://puppet.com/security/cve/cve-2013-0156
Copyright	Copyright (C) 2013 Greenbone AG

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.