Security update for Ruby On Rails

SUSE Security Update: Security update for Ruby On Rails
Announcement ID: SUSE-SU-2012:0434-1
Rating: moderate
References: #668817 #712057 #712058 #712060 #712062
Affected Products:
  • WebYaST [Appliance - Tools]
  • WebYaST 1.2
  • SUSE Studio Standard Edition 1.2
  • SUSE Studio Onsite 1.2
  • SUSE Studio Extension for System z 1.2
  • SUSE Linux Enterprise Software Development Kit 11 SP1
    		•

    An update that fixes 9 vulnerabilities is now available. It includes two new package versions.

    Description:


    This update of Ruby on Rails to 2.3.14 fixes the following
    security issues:

    * CVE-2011-2930 - SQL-injection in quote_table_name
    function via specially crafted column names (bnc#712062)
    * CVE-2011-2931 - Cross-Site Scripting (XSS) in the
    strip_tags helper (bnc#712057)
    * CVE-2011-3186 - Response Splitting (bnc#712058)
    * CVE-2010-3933 - Arbitrary modification of records via
    specially crafted form parameters (bnc#712058)
    * CVE-2011-0446 - Cross-Site Scripting (XSS) in the
    mail_to helper (bnc#668817)
    * CVE-2011-0447 - Improper validation of
    'X-Requested-With' header (bnc#668817)
    * CVE-2011-0448 - SQL-injection caused by improperly
    sanitized arguments to the limit function (bnc#668817)
    * CVE-2011-0449 - Bypass of access restrictions via
    specially crafted action names (bnc#668817)
    * CVE-2011-2932 - Cross-Site Scripting in
    output_safety.rb (bnc#712060)

    Security Issue reference:

    * CVE-2011-2930
    >
    * CVE-2011-2931
    >
    * CVE-2011-3186
    >
    * CVE-2010-3933
    >
    * CVE-2011-0446
    >
    * CVE-2011-0447
    >
    * CVE-2011-0448
    >
    * CVE-2011-0449
    >
    * CVE-2011-2932
    >

    Patch Instructions:

    To install this SUSE Security Update use YaST online_update.
    Alternatively you can run the command listed for your product:

    • WebYaST [Appliance - Tools]:
      zypper in -t patch slewystsp1-rubyonrails-2314-201202-5884
    • WebYaST 1.2:
      zypper in -t patch slewyst12-rubyonrails-2314-201202-5884
    • SUSE Studio Standard Edition 1.2:
      zypper in -t patch sleslms12-rubyonrails-2314-201202-5884
    • SUSE Studio Onsite 1.2:
      zypper in -t patch slestso12-rubyonrails-2314-201202-5884
    • SUSE Studio Extension for System z 1.2:
      zypper in -t patch slestso12-rubyonrails-2314-201202-5884
    • SUSE Linux Enterprise Software Development Kit 11 SP1:
      zypper in -t patch sdksp1-rubyonrails-2314-201202-5884

    To bring your system up-to-date, use "zypper patch".

    Package List:

    • WebYaST [Appliance - Tools] (i586 ia64 ppc64 s390x x86_64) [New Version: 1.1.2 and 2.3.14]:
    • rubygem-actionmailer-2_3-2.3.14-0.7.4.3
    • rubygem-actionpack-2_3-2.3.14-0.7.4.3
    • rubygem-activerecord-2_3-2.3.14-0.7.4.3
    • rubygem-activeresource-2_3-2.3.14-0.7.4.3
    • rubygem-activesupport-2_3-2.3.14-0.7.4.3
    • rubygem-rack-1.1.2-0.8.8.3
    • rubygem-rails-2_3-2.3.14-0.7.4.3
    • WebYaST 1.2 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.1.2 and 2.3.14]:
    • rubygem-actionmailer-2_3-2.3.14-0.7.4.3
    • rubygem-actionpack-2_3-2.3.14-0.7.4.3
    • rubygem-activerecord-2_3-2.3.14-0.7.4.3
    • rubygem-activeresource-2_3-2.3.14-0.7.4.3
    • rubygem-activesupport-2_3-2.3.14-0.7.4.3
    • rubygem-rack-1.1.2-0.8.8.3
    • rubygem-rails-2_3-2.3.14-0.7.4.3
    • SUSE Studio Standard Edition 1.2 (x86_64) [New Version: 1.1.2 and 2.3.14]:
    • rubygem-actionmailer-2_3-2.3.14-0.7.4.3
    • rubygem-actionpack-2_3-2.3.14-0.7.4.3
    • rubygem-activerecord-2_3-2.3.14-0.7.4.3
    • rubygem-activeresource-2_3-2.3.14-0.7.4.3
    • rubygem-activesupport-2_3-2.3.14-0.7.4.3
    • rubygem-rack-1.1.2-0.8.8.3
    • rubygem-rails-2_3-2.3.14-0.7.4.3
    • SUSE Studio Standard Edition 1.2 (noarch) [New Version: 2.3.14]:
    • rubygem-rails-2.3.14-0.8.6.1
    • SUSE Studio Onsite 1.2 (x86_64) [New Version: 1.1.2 and 2.3.14]:
    • rubygem-actionmailer-2_3-2.3.14-0.7.4.3
    • rubygem-actionpack-2_3-2.3.14-0.7.4.3
    • rubygem-activerecord-2_3-2.3.14-0.7.4.3
    • rubygem-activeresource-2_3-2.3.14-0.7.4.3
    • rubygem-activesupport-2_3-2.3.14-0.7.4.3
    • rubygem-rack-1.1.2-0.8.8.3
    • rubygem-rails-2_3-2.3.14-0.7.4.3
    • SUSE Studio Extension for System z 1.2 (s390x) [New Version: 1.1.2 and 2.3.14]:
    • rubygem-actionmailer-2_3-2.3.14-0.7.4.3
    • rubygem-actionpack-2_3-2.3.14-0.7.4.3
    • rubygem-activerecord-2_3-2.3.14-0.7.4.3
    • rubygem-activeresource-2_3-2.3.14-0.7.4.3
    • rubygem-activesupport-2_3-2.3.14-0.7.4.3
    • rubygem-rack-1.1.2-0.8.8.3
    • rubygem-rails-2_3-2.3.14-0.7.4.3
    • SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.1.2 and 2.3.14]:
    • rubygem-actionmailer-2_3-2.3.14-0.7.4.3
    • rubygem-actionpack-2_3-2.3.14-0.7.4.3
    • rubygem-activerecord-2_3-2.3.14-0.7.4.3
    • rubygem-activeresource-2_3-2.3.14-0.7.4.3
    • rubygem-activesupport-2_3-2.3.14-0.7.4.3
    • rubygem-rack-1.1.2-0.8.8.3
    • rubygem-rails-2_3-2.3.14-0.7.4.3
    • SUSE Linux Enterprise Software Development Kit 11 SP1 (noarch) [New Version: 2.3.14]:
    • rubygem-rails-2.3.14-0.8.6.1

    References:

    • http://support.novell.com/security/cve/CVE-2010-3933.html
    • http://support.novell.com/security/cve/CVE-2011-0446.html
    • http://support.novell.com/security/cve/CVE-2011-0447.html
    • http://support.novell.com/security/cve/CVE-2011-0448.html
    • http://support.novell.com/security/cve/CVE-2011-0449.html
    • http://support.novell.com/security/cve/CVE-2011-2930.html
    • http://support.novell.com/security/cve/CVE-2011-2931.html
    • http://support.novell.com/security/cve/CVE-2011-2932.html
    • http://support.novell.com/security/cve/CVE-2011-3186.html
    • https://bugzilla.novell.com/668817
    • https://bugzilla.novell.com/712057
    • https://bugzilla.novell.com/712058
    • https://bugzilla.novell.com/712060
    • https://bugzilla.novell.com/712062
    • http://download.suse.com/patch/finder/?keywords=a9a7e5b0e289aeb951fcc43761e059bf