A security flaw was found in the way rubygem-actionpack, the web-flow and rendering framework putting the VC in MVC, performed SQL query generation based on the content of params hash. If a Ruby on Rails application used Rack to parse query parameters, those parameters were not sanitized for the presence of the 'nil' value and that application relied, when performing user authentication, certain params value not to be 'nil', a remote attacker could use this flaw to bypass the authentication, leading to information disclosure and / or unauthorized access to the service. Upstream advisory announcement: [1] http://groups.google.com/group/rubyonrails-security/browse_thread/thread/f1203e3376acec0f Relevant patches: [2] http://groups.google.com/group/rubyonrails-security/attach/d890f8d58b5fbf32/3-0-null_param.patch?part=3 (against v3.0 branch) [3] http://groups.google.com/group/rubyonrails-security/attach/d890f8d58b5fbf32/3-1-null_param.patch?part=5 (against v3.1 branch) [4] http://groups.google.com/group/rubyonrails-security/attach/d890f8d58b5fbf32/3-2-null_param.patch?part=4 (against v3.2 branch)
Further details how to reproduce the problem (from [1]): -------------------------------------------------------- For example, a system has password reset with token functionality: unless params[:token].nil? user = User.find_by_token(params[:token]) user.reset_password! end An attacker can craft a request such that `params[:token]` will return `[nil]`. The `[nil]` value will bypass the test for nil, but will still add an "IS NULL" clause to the SQL query.
This issue affects the versions of the rubygem-actionpack package, as shipped with Fedora release of 15 and 16. Please schedule an update. -- This issue did NOT affect the version of the rubygem-actionpack package, as shipped with Fedora EPEL 5. The affected functionality is not present there yet.
Created rubygem-actionpack tracking bugs for this issue Affects: fedora-all [bug 827364]
rubygem-actionpack-3.0.11-4.fc17 has been pushed to the Fedora 17 stable repository. If problems still persist, please make note of it in this bug report.
rubygem-actionpack-3.0.10-6.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report.
rubygem-actionpack-3.0.5-8.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products: CloudForms for RHEL 6 Via RHSA-2012:1542 https://rhn.redhat.com/errata/RHSA-2012-1542.html
This issue has been addressed in following products: Red Hat Subscription Asset Manager 1.1 Via RHSA-2013:0154 https://rhn.redhat.com/errata/RHSA-2013-0154.html
This issue has been addressed in following products: RHEL 6 Version of OpenShift Enterprise Via RHSA-2013:0582 https://rhn.redhat.com/errata/RHSA-2013-0582.html