Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by tedunangst on Monday January 28, 2013 @09:54PM (#5132091)

I think you mean roots some webserver machine, not the local machine running the browser?

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by patio11 on Monday January 28, 2013 @09:56PM (#5132094)

I mean "This will also let the adversary root your Macbook, Rails developers, if e.g. localhost:3000 is running an unpatched Rails app."

One would think this is strictly less important than "root your server" but that hasn't been true for 100% of Rails developers that I've recently spoken to so, if losing your Macbook is the inducement you need to drop everything you are doing and patch, I will supply that inducement liberally.

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by euroclydon on Wednesday January 30, 2013 @12:40PM (#5140644)

My website gets a handful of single-page visits, referred from some real sketchy domains, every day. They are very regular and appear to be automated. I wonder if it's part of a broader scam to get website owners to visit sites which root their dev machine via 0-day browser or server vulnerabilities?

[ Parent | on HN ]

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by tedunangst on Monday January 28, 2013 @09:58PM (#5132101)

oh, yeah, that too. :)

[ Parent | on HN ]