Bug 843711 (CVE-2012-3424) - CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest
Summary: CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_reques...
Status: CLOSED ERRATA
Alias: CVE-2012-3424
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20120726,reported=2...
Keywords: Reopened, Security
Depends On: 843913 843916 843924 847390 895908 896175
Blocks: 767033 836071 851409 917158
TreeView+ depends on / blocked
 
Reported: 2012-07-27 06:44 UTC by Kurt Seifried
Modified: 2019-06-08 19:12 UTC (History)
14 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2013-03-28 22:15:31 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2012:1542 normal SHIPPED_LIVE Moderate: CloudForms Commons 1.1 security update 2012-12-05 00:29:06 UTC
Gentoo 428254 None None None 2012-07-27 08:32:24 UTC
Red Hat Product Errata RHSA-2013:0154 normal SHIPPED_LIVE Critical: Ruby on Rails security update 2013-01-11 01:38:55 UTC
Red Hat Product Errata RHSA-2013:0582 normal SHIPPED_LIVE Moderate: Red Hat OpenShift Enterprise 1.1.1 update 2013-03-01 00:05:18 UTC

Description Kurt Seifried 2012-07-27 06:44:36 UTC
tenderlove@ruby-lang.org reports:

DoS Vulnerability in authenticate_or_request_with_http_digest

There is a DoS vulnerability in Action Pack digest authentication handling in Rails.
This vulnerability has been assigned the CVE identifier CVE-2012-3424.

Versions Affected:  3.x.
Not affected:       2.3.5 - 2.3.14
Fixed Versions:     3.0.16, 3.1.7, 3.2.7

Impact 
------ 

All users using Digest Authentication support in Rails should upgrade
immediately.  Impacted code uses any of the `with_http_digest` controller
helper methods.  For example:

    class MyController < ApplicationController
      def index
        authenticate_or_request_with_http_digest(REALM) do |uname|
          # ...
        end
      end
    end

Releases 
-------- 
The 3.0.16, 3.1.7 & 3.2.7 releases are available at the normal locations. 


Workarounds 
----------- 
There are no feasible workarounds for this issue. 


Patches 
------- 
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series.  They are in git-am format and consist of a single changeset. 

* 3-0-digest_auth_dos.patch - Patch for 3.0 series 
* 3-1-digest_auth_dos.patch - Patch for 3.1 series 
* 3-2-digest_auth_dos.patch - Patch for 3.2 series 

Please note that only the 3.1.x and 3.2.x series are supported at present.  Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits 
------- 
Thanks to Charlie Somerville for reporting this issue!

References:

http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released/
https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM

diff --git a/actionpack/lib/action_controller/metal/http_authentication.rb b/actionpack/lib/action_controller/metal/http_authentication.rb
index 9f2f547..fe4ab65 100644
--- a/actionpack/lib/action_controller/metal/http_authentication.rb
+++ b/actionpack/lib/action_controller/metal/http_authentication.rb
@@ -227,9 +227,9 @@ module ActionController
       end
 
       def decode_credentials(header)
-        Hash[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
+        HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
           key, value = pair.split('=', 2)
-          [key.strip.to_sym, value.to_s.gsub(/^"|"$/,'').gsub(/'/, '')]
+          [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')]
         end]
       end

Comment 1 Kurt Seifried 2012-07-27 16:21:10 UTC
Created rubygem-rails tracking bugs for this issue

Affects: fedora-all [bug 843913]

Comment 3 Kurt Seifried 2012-07-27 16:54:36 UTC
Created rubygem-rails tracking bugs for this issue

Affects: epel-5 [bug 843924]

Comment 5 Fedora Update System 2012-08-09 23:18:32 UTC
rubygem-actionpack-3.0.11-6.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2012-08-09 23:26:12 UTC
rubygem-actionpack-3.0.10-8.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 errata-xmlrpc 2012-12-04 19:31:50 UTC
This issue has been addressed in following products:

  CloudForms for RHEL 6

Via RHSA-2012:1542 https://rhn.redhat.com/errata/RHSA-2012-1542.html

Comment 9 Rob Millner 2012-12-11 01:11:52 UTC
ruby193-rubygem-actionpack-3.2.8-1.el6.noarch is installed in OpenShift and used by the broker, site and ruby 1.9 applications.

Comment 10 Kurt Seifried 2012-12-14 19:20:20 UTC
Closing, fixed in OpenShift and CloudForms

Comment 11 errata-xmlrpc 2013-01-10 20:42:23 UTC
This issue has been addressed in following products:

  Red Hat Subscription Asset Manager 1.1

Via RHSA-2013:0154 https://rhn.redhat.com/errata/RHSA-2013-0154.html

Comment 15 errata-xmlrpc 2013-02-28 19:07:52 UTC
This issue has been addressed in following products:

  RHEL 6 Version of OpenShift Enterprise

Via RHSA-2013:0582 https://rhn.redhat.com/errata/RHSA-2013-0582.html


Note You need to log in before you can comment on or make changes to this bug.