[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20140529132746.37d7f6e9.reed@reedloden.com>
Date: Thu, 29 May 2014 13:27:46 -0700
From: Reed Loden <reed@...dloden.com>
To: Jacob Kaplan-Moss <jacob@...oku.com>
Cc: oss-security@...ts.openwall.com, Rafael Mendonça França <rafaelmfranca@...il.com>, "security@...oku.com"
<security@...oku.com>
Subject: Re: [AMENDED] [CVE-2014-0130] Ruby on Rails:
Directory Traversal Vulnerability With Certain Route Configurations
On Wed, 7 May 2014 11:53:12 -0500
Jacob Kaplan-Moss <jacob@...oku.com> wrote:
> Can you clarify what these "additional attack vectors" are? We've been
> looking at this closely here at Heroku, and as far as we can tell it's only
> the original vector (*action/:action). What are we missing here?
...
> We'd like to be better able to evaluate if we're vulnerable -- and, more
> importantly, we'd like to understand if this is a big enough deal for us to
> notify our customers and directly encourage them to upgrade (a step we've
> taken in the past). However, without more details about these "additional
> vectors" we're kinda shooting in the dark. Can you share more details?
Matasano just released a paper on this particular vulnerability that
you might want to check out.
"Jeff Jarmoc explains why the recent Ruby on Rails
'implicit render' vulnerability (CVE-2014-0130) is more serious than
many have been lead to believe. In this paper he shows how to go from
an arbitrary file read under highly unusual configurations to RCE in
more common setups."
http://matasano.com/research/AnatomyOfRailsVuln-CVE-2014-0130.pdf
~reed
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
