Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Multiple vulnerabilities in parameter parsing in Action Pack

groups.google.com

Post reply on HN
Print view View original

81–90 of 294 posts

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#81

Post by fwilhelm »

steveklabnik wrote: post #54
fwilhelm wrote: post #39

For those of you interested in more details about this bug: I've posted a first analysis at http://www.insinuator.net/2013/01/rails-yaml/

I don't think this is very responsible of you. You should post this, but you should really wait a week or so.

The post does not include any directly usable exploit code and does not describe command execution vectors. Furthermore information about the bug were published on twitter almost a week ago. But I probably will not convince you about the advantages of Full Disclosure :)

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#82

Post by senorprogrammer »

rschmitty wrote: post #45

Rails noob here... with this and the other vulnerability from a few days ago, do all you need to do is update your rails gem to become safe? Current version at time of my post is 3.2.11, if I'm using that am I safe or do I need to perform additional steps?

That's exactly what you need to do. You're safe.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#83

Post by davesims »

techscruggs wrote: post #75
tenderlove wrote: post #16

I'm just commenting here so that people can have a central thread for love / hatred. ;-) But seriously. This is extremely critical, please upgrade!

Aaron, thank you for all your hard work and making the Rails community fun to be a part of. ... upgrading now!

Agreed. Watching this develop from behind the scenes (at a distance), I'm not sure any core team could have done better managing the deployment and announcement in a more timely and careful fashion. Well played.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#84

Post by revelation »

phillmv wrote: post #52
jrabone wrote: post #44

Earlier quoted context omitted.

Who'd have thought it? Hugely dynamic language turns out to be difficult to audit or analyse for security issues. It was never about Java(C, C++) vs. Ruby despite what fanboys on either side made out. It was about conservative vs. devil-may-care. All that "convenience" and "it's so clean" came at the price of a whole load of code executed behind the scenes. You didn't write it, and the Gods of TDD preached that you d…

This is a straw man. These kinds of issues are open to all software. I'm happy you work in the kind of place that audits all of its software, though. I'm sure you've all read through all of Hibernate, Spring and not to mention all the .NET framework code.

That is a straw man. Nobody claims there are not issues in other software.

The claim here is that people in dynamic languages tend to misuse that and write all sorts of magic that are pure gold for 10-line snippets but open up a vast attack surface, like building completely arbitrary objects from string input.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#85

Post by nathan_f77 »

clickonchris wrote: post #71

Upgrade instructions: update your Gemfile and set the version you want. In my case: gem 'rails', '3.2.10' locally, run 'bundle update rails' which will update your Gemfile.lock check-in and deploy your code. If you are using capistranso, the default 'deploy' task should handle everything for you. Otherwise, run 'bundle update rails' on your production server.

You need rails 3.2.11, which has the patch.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#86

Post by mtrimpe »

jrabone wrote: post #44
sergiotapia wrote: post #14

As a newcomer to the Rails ecosystem all these posts of vunlerabilities and open doors leaves a bad taste in my mouth. God know I love programming in Ruby now, but is Rails really that insecure?

Who'd have thought it? Hugely dynamic language turns out to be difficult to audit or analyse for security issues. It was never about Java(C, C++) vs. Ruby despite what fanboys on either side made out. It was about conservative vs. devil-may-care. All that "convenience" and "it's so clean" came at the price of a whole load of code executed behind the scenes. You didn't write it, and the Gods of TDD preached that you d…

Wait, which one of us are you?

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#87

Post by jasim »

tenderlove wrote: post #16

I'm just commenting here so that people can have a central thread for love / hatred. ;-) But seriously. This is extremely critical, please upgrade!

The Rails security core team and the awesome collaborators deserve a raise. Thanks for your continued vigilance and effort.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#88

Post by danso »

sdoowpilihp wrote: post #34

Can anyone with a more intimate knowledge of the inner workings of Ruby on Rails speak to how detrimental this exploit is in practice? I seem to recall a fair number of people feeling the SQL injection exploit from a few days ago was being blown out of proportion and I was wondering how this particular exploit stacks up against it.

I'm not going to say "told you so" because I said nothing and I'm just a layman in this...but when people were pointing out last week that the bug was "overblown" I had wondered if they were underestimating the tendency for such vulnerable patterns to propagate. The mechanisms that let even an edge case in are not always isolated.

Re: Multiple vulnerabilities in parameter parsing in Action Pack

#90

Post by [deleted] »

joevandyk wrote: post #30
tenderlove wrote: post #16

I'm just commenting here so that people can have a central thread for love / hatred. ;-) But seriously. This is extremely critical, please upgrade!

These are the commits that need to be pulled in, right? https://github.com/rails/rails/commit/d5cd97baa44fa66dc68104... https://github.com/rails/rails/commit/43109ecb986470ef023a7e... Are there others?

[deleted]
Post reply on HN