Bug 843711 (CVE-2012-3424)

Summary: CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: bkabrda, bkearney, hbrock, jeckersb, katello-internal, mastahnke, mmccune, mmorsi, morazi, rmillner, sseago, tkramer, vanmeeuwen+fedora, vondruch
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20120726,reported=20120726,source=oss-security,cvss2=4.3/AV:N/AC:M/Au:N/C:N/I:N/A:P,cloudformscommon-1/rubygem-actionpack=affected,sam-1/rubygem-actionpack=affected,openshift-enterprise-1/rubygem-actionpack=affected,openshift-enterprise-1/ruby193-rubygem-actionpack=notaffected,openshift-1/rubygem-actionpack=affected,fedora-all/rubygem-actionpack=affected,epel-5/rubygem-actionpack=notaffected
Fixed In Version: rubygem-actionpack 3.0.16, rubygem-actionpack 3.1.7, rubygem-actionpack 3.2.7 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-03-28 18:15:31 EDT Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Bug Depends On: 843913, 843916, 843924, 847390, 895908, 896175    
Bug Blocks: 767033, 836071, 851409, 917158    

Description Kurt Seifried 2012-07-27 02:44:36 EDT
tenderlove@ruby-lang.org reports:

DoS Vulnerability in authenticate_or_request_with_http_digest

There is a DoS vulnerability in Action Pack digest authentication handling in Rails.
This vulnerability has been assigned the CVE identifier CVE-2012-3424.

Versions Affected:  3.x.
Not affected:       2.3.5 - 2.3.14
Fixed Versions:     3.0.16, 3.1.7, 3.2.7

Impact 
------ 

All users using Digest Authentication support in Rails should upgrade
immediately.  Impacted code uses any of the `with_http_digest` controller
helper methods.  For example:

    class MyController < ApplicationController
      def index
        authenticate_or_request_with_http_digest(REALM) do |uname|
          # ...
        end
      end
    end

Releases 
-------- 
The 3.0.16, 3.1.7 & 3.2.7 releases are available at the normal locations. 


Workarounds 
----------- 
There are no feasible workarounds for this issue. 


Patches 
------- 
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series.  They are in git-am format and consist of a single changeset. 

* 3-0-digest_auth_dos.patch - Patch for 3.0 series 
* 3-1-digest_auth_dos.patch - Patch for 3.1 series 
* 3-2-digest_auth_dos.patch - Patch for 3.2 series 

Please note that only the 3.1.x and 3.2.x series are supported at present.  Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits 
------- 
Thanks to Charlie Somerville for reporting this issue!

References:

http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released/
https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM

diff --git a/actionpack/lib/action_controller/metal/http_authentication.rb b/actionpack/lib/action_controller/metal/http_authentication.rb
index 9f2f547..fe4ab65 100644
--- a/actionpack/lib/action_controller/metal/http_authentication.rb
+++ b/actionpack/lib/action_controller/metal/http_authentication.rb
@@ -227,9 +227,9 @@ module ActionController
       end
 
       def decode_credentials(header)
-        Hash[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
+        HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
           key, value = pair.split('=', 2)
-          [key.strip.to_sym, value.to_s.gsub(/^"|"$/,'').gsub(/'/, '')]
+          [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')]
         end]
       end
Comment 1 Kurt Seifried 2012-07-27 12:21:10 EDT
Created rubygem-rails tracking bugs for this issue

Affects: fedora-all [bug 843913]
Comment 3 Kurt Seifried 2012-07-27 12:54:36 EDT
Created rubygem-rails tracking bugs for this issue

Affects: epel-5 [bug 843924]
Comment 5 Fedora Update System 2012-08-09 19:18:32 EDT
rubygem-actionpack-3.0.11-6.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2012-08-09 19:26:12 EDT
rubygem-actionpack-3.0.10-8.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 errata-xmlrpc 2012-12-04 14:31:50 EST
This issue has been addressed in following products:

  CloudForms for RHEL 6

Via RHSA-2012:1542 https://rhn.redhat.com/errata/RHSA-2012-1542.html
Comment 9 Rob Millner 2012-12-10 20:11:52 EST
ruby193-rubygem-actionpack-3.2.8-1.el6.noarch is installed in OpenShift and used by the broker, site and ruby 1.9 applications.
Comment 10 Kurt Seifried 2012-12-14 14:20:20 EST
Closing, fixed in OpenShift and CloudForms
Comment 11 errata-xmlrpc 2013-01-10 15:42:23 EST
This issue has been addressed in following products:

  Red Hat Subscription Asset Manager 1.1

Via RHSA-2013:0154 https://rhn.redhat.com/errata/RHSA-2013-0154.html
Comment 15 errata-xmlrpc 2013-02-28 14:07:52 EST
This issue has been addressed in following products:

  RHEL 6 Version of OpenShift Enterprise

Via RHSA-2013:0582 https://rhn.redhat.com/errata/RHSA-2013-0582.html