Metasploit Rails 3 Remote Code Execution Hours Away

Re:Metasploit Rails 3 Remote Code Execution Hours Away by ab on Thursday January 10, 2013 @12:14AM (#5035591)

There's an enormous difference between serializers that make any effort at all to be safe, and those like Ruby's YAML library, which make no effort. Python's YAML, for example, exposes a safe_load() method.

It's really criminally negligent that no such method exists in Ruby's YAML library.

[ Parent | on HN ]

Re:Metasploit Rails 3 Remote Code Execution Hours Away by ghostganz on Thursday January 10, 2013 @03:42AM (#5036076)

Python's Pickle lib had something similar to safe_load(), that they removed because it gave a false sense of security.

[ Parent | on HN ]

Re:Metasploit Rails 3 Remote Code Execution Hours Away by X-Istence on Thursday January 10, 2013 @08:39AM (#5036750)

If you are accepting pickled objects from a remote and using it ... you are an idiot.

[ Parent | on HN ]