Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 514
Alerts This Week
Warning Icon 1 514

Gentoo: GLSA 202302-18 Moderate: Enhanced Metadata Exposure Vulnerability

gentoo
Calendar Grey January 21, 2014
Scroller Gentoo
Gentoo Linux Security Advisory GLSA 201401-23 tackles a minor severity XSS vulnerability in User Input Handler, improving defense mechanisms.
A vulnerability in Active Record could allow a remote attacker to inject SQL commands.

Summary

An Active Record method parameter can mistakenly be used as a scope.

Topics%20covered

Topics Covered

security advisory update gentoo threat sql injection low severity active record

Resolution

All Active Record users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v ">=dev-ruby/activerecord-2.3.14-r1"

References

[ 1 ] CVE-2012-6496 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6496

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201401-22
style>.gentoo_availability{display:block;}

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
low
Lowest
Low
Medium
High
Critical

Severity: Low
Title: Active Record: SQL injection
Date: January 21, 2014
Bugs: #449826
ID: 201401-22

Topics%20covered

Topics Covered

security advisory update gentoo threat sql injection low severity active record

Synopsis

A vulnerability in Active Record could allow a remote attacker to inject SQL commands.

Background

Active Record is a Ruby gem that allows database entries to be manipulated as objects.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-ruby/activerecord < 2.3.14-r1 >= 2.3.14-r1

Impact

===== A remote attacker could use specially crafted input to execute arbitrary SQL statements.

Workaround

The vulnerability may be mitigated by converting the input to an expected value. This is accomplished by changing instances of 'Post.find_by_id(params[:id])' in code using Active Record to 'Post.find_by_id(params[:id].to_s)'