Use Rails? Check yourself for the YAML exploit

Re:Use Rails? Check yourself for the YAML exploit by tibbon on Friday February 01, 2013 @04:51PM (#5153726)

So what is the exploit, and how do we fix it?

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by patio11 on Friday February 01, 2013 @04:55PM (#5153741)

There have been multiple vulnerabilities discovered with semi-related causes. These all have (several) exploits which are widely available. The upshot is that they permit remote code execution (i.e. "root the server") on virtually all Rails applications accessible on the public Internet and, perhaps, some which are not.

Rails has been updated to close these particular vulnerabilities. The proper versions are listed in these two advisories. There are also work-arounds if your app is not in a state to just upgrade Rails. If your app is in that state, I strongly advise you that your only priority for the next several days is fixing that, because one should have high confidence that there will be more vulnerabilities announced soonish.

https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by ainsleyb on Friday February 01, 2013 @04:53PM (#5153734)

I've posted a little bit more on our blog at: http://blog.tinfoilsecurity.com/use-rails-check-yourself-for...

[ Parent | on HN ]

Re:Use Rails? Check yourself for the YAML exploit by px43 on Friday February 01, 2013 @05:05PM (#5153806)

This is about the equivalent of putting a single quote in a GET variable to detect sql injection. It tries to detect any bugs in the bug class, rather than a specific bug. The solution is different depending on what component is broken.

[ Parent | on HN ]