Bug 843711 - (CVE-2012-3424) CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest
CVE-2012-3424 rubygem-actionpack: DoS vulnerability in authenticate_or_reques...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20120726,reported=2...
: Reopened, Security
Depends On: 843913 843916 843924 847390 895908 896175
Blocks: 767033 836071 851409 917158
  Show dependency treegraph
 
Reported: 2012-07-27 02:44 EDT by Kurt Seifried
Modified: 2015-07-31 02:52 EDT (History)
14 users (show)

See Also:
Fixed In Version: rubygem-actionpack 3.0.16, rubygem-actionpack 3.1.7, rubygem-actionpack 3.2.7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-03-28 18:15:31 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Gentoo 428254 None None None 2012-07-27 04:32:24 EDT

  None (edit)
Description Kurt Seifried 2012-07-27 02:44:36 EDT
tenderlove@ruby-lang.org reports:

DoS Vulnerability in authenticate_or_request_with_http_digest

There is a DoS vulnerability in Action Pack digest authentication handling in Rails.
This vulnerability has been assigned the CVE identifier CVE-2012-3424.

Versions Affected:  3.x.
Not affected:       2.3.5 - 2.3.14
Fixed Versions:     3.0.16, 3.1.7, 3.2.7

Impact 
------ 

All users using Digest Authentication support in Rails should upgrade
immediately.  Impacted code uses any of the `with_http_digest` controller
helper methods.  For example:

    class MyController < ApplicationController
      def index
        authenticate_or_request_with_http_digest(REALM) do |uname|
          # ...
        end
      end
    end

Releases 
-------- 
The 3.0.16, 3.1.7 & 3.2.7 releases are available at the normal locations. 


Workarounds 
----------- 
There are no feasible workarounds for this issue. 


Patches 
------- 
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series.  They are in git-am format and consist of a single changeset. 

* 3-0-digest_auth_dos.patch - Patch for 3.0 series 
* 3-1-digest_auth_dos.patch - Patch for 3.1 series 
* 3-2-digest_auth_dos.patch - Patch for 3.2 series 

Please note that only the 3.1.x and 3.2.x series are supported at present.  Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits 
------- 
Thanks to Charlie Somerville for reporting this issue!

References:

http://weblog.rubyonrails.org/2012/7/26/ann-rails-3-2-7-has-been-released/
https://groups.google.com/forum/?fromgroups#!topic/rubyonrails-security/vxJjrc15qYM

diff --git a/actionpack/lib/action_controller/metal/http_authentication.rb b/actionpack/lib/action_controller/metal/http_authentication.rb
index 9f2f547..fe4ab65 100644
--- a/actionpack/lib/action_controller/metal/http_authentication.rb
+++ b/actionpack/lib/action_controller/metal/http_authentication.rb
@@ -227,9 +227,9 @@ module ActionController
       end
 
       def decode_credentials(header)
-        Hash[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
+        HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
           key, value = pair.split('=', 2)
-          [key.strip.to_sym, value.to_s.gsub(/^"|"$/,'').gsub(/'/, '')]
+          [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')]
         end]
       end
Comment 1 Kurt Seifried 2012-07-27 12:21:10 EDT
Created rubygem-rails tracking bugs for this issue

Affects: fedora-all [bug 843913]
Comment 3 Kurt Seifried 2012-07-27 12:54:36 EDT
Created rubygem-rails tracking bugs for this issue

Affects: epel-5 [bug 843924]
Comment 5 Fedora Update System 2012-08-09 19:18:32 EDT
rubygem-actionpack-3.0.11-6.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2012-08-09 19:26:12 EDT
rubygem-actionpack-3.0.10-8.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 errata-xmlrpc 2012-12-04 14:31:50 EST
This issue has been addressed in following products:

  CloudForms for RHEL 6

Via RHSA-2012:1542 https://rhn.redhat.com/errata/RHSA-2012-1542.html
Comment 9 Rob Millner 2012-12-10 20:11:52 EST
ruby193-rubygem-actionpack-3.2.8-1.el6.noarch is installed in OpenShift and used by the broker, site and ruby 1.9 applications.
Comment 10 Kurt Seifried 2012-12-14 14:20:20 EST
Closing, fixed in OpenShift and CloudForms
Comment 11 errata-xmlrpc 2013-01-10 15:42:23 EST
This issue has been addressed in following products:

  Red Hat Subscription Asset Manager 1.1

Via RHSA-2013:0154 https://rhn.redhat.com/errata/RHSA-2013-0154.html
Comment 15 errata-xmlrpc 2013-02-28 14:07:52 EST
This issue has been addressed in following products:

  RHEL 6 Version of OpenShift Enterprise

Via RHSA-2013:0582 https://rhn.redhat.com/errata/RHSA-2013-0582.html

Note You need to log in before you can comment on or make changes to this bug.