Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2014.1190
ruby-activerecord-3.2 security update
21 July 2014
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: ruby-activerecord-3.2
Publisher: Debian
Operating System: Debian GNU/Linux 7
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2014-3483 CVE-2014-3482
Reference: ESB-2014.1166
ESB-2014.1165
Original Bulletin:
http://www.debian.org/security/2014/dsa-2982
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-2982-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
July 19, 2014 http://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : ruby-activerecord-3.2
CVE ID : CVE-2014-3482 CVE-2014-3483
Sean Griffin discovered two vulnerabilities in the PostgreSQL adapter
for Active Record which could lead to SQL injection.
For the stable distribution (wheezy), these problems have been fixed in
version 3.2.6-5+deb7u1. Debian provides two variants of "Ruby on Rails"
in Wheezy (2.3 and 3.2). Support for the 2.3 variants had to be ceased
at this point. This affects the following source packages:
ruby-actionmailer-2.3, ruby-actionpack-2.3 ruby-activerecord-2.3,
ruby-activeresource-2.3, ruby-activesupport-2.3 and ruby-rails-2.3. The
version of Redmine in Wheezy still requires 2.3, you can use an updated
version from backports.debian.org which is compatible with rails 3.2.
For the unstable distribution (sid), these problems have been fixed in
version 3.2.19-1 of the rails-3.2 source package.
We recommend that you upgrade your ruby-activerecord-3.2 packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJTykOCAAoJEBDCk7bDfE4212QP/02xh9SxMXSQ+K/UGeCNrcEk
ndZUWOwHsNmEzd7lauAfD8RiBTVSaHULS46LElcjlIhsEm3c28G7E+iyiRXbHzn/
HHVmwCuiqctXH2gcz0xct/uzUHCBG0OD6Q+EjERHo9SNirUtftjZUCekP6C8Qx3H
+fuvsGrvFupU1Ckio+zSTzgodBY807JIbTbX3VR3h0o2ckYFveIOvLtR7+c+a0QF
zR60hgoHQTFuwF7oaCJPb9+KMnFki0SyyOtEDbWpCoQ3mwmlvepQfYIc+jI8bEni
S7d/XWqzfqSrhRSfNkFnNLEOMRFZPhrA82G9RPQJ2/h2qh8GH6tUYZh3nL96BX03
kc+y96QZvSVYGIM8AYirZu2n5vGdaY9/kUtwIU3xUfPPtQ2mbvalYSIqy1gpAVbw
HCKBI5UW8L/AJBSCnWVVLWIxaepLN6ldf/8f27Q3wwJ3OQDPSgohji0QeZik2Uro
APMR1Bmi21r4MmbcoBk4Xq1KeHnqXzrdUOZvqxTKT+8LMXTDGZNRFo8WWYNHS/DN
y98ud8YyhtdAQMlO5hCHycTdRhvrW6Bjf7j/CCKBmOy/Ni0Y3FT/wIB/OMnMO+zj
XS1BDSDUdwIcuJ/+vjm4Gi37ByIe3QsRa2IASJs6Y0NaVk6guu2iuB8lWcA+OxOp
rhl2V1RLej6qxzaZGgGw
=1eAA
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBU8xf1RLndAQH1ShLAQLtDBAAuYcYFD5awnezGqFnmepj80Mkw778IERo
LqMDNVxlDwveeTC/xX6rVvhMqp9f6Lrw9mNysCENKh0J5iT3V4yaq7Y+f7sD8uS0
mDbF7/7rUCFn8EGA4uXjL6Y9TVrJFwU68aqgVcYcniP9kGitSfV50cmTqWTDrmvY
coYa7z8H3GookdBrwrxYS4XNbesPdX15o/pffFMKRQZbQM+kGT/fmeHa3ELe66nf
m3u1pBJ8EkLJCLzuLMZ0knHxaNZFbGLHXnsMTK7PnU3lGksd1UuOyYex4FVB8S7b
1VQ/zqHNU35UHEhKFTreXK/nH9rVmiCST4+Dvpdt2fxaItLVDrL/9CAs8B8UGzKC
1BN4ShusH9Du8maP0WQIfx8W6VX9pV3nUfWZprcPD5WUqt5WcJbzPlezg/Fc0Lhk
g4F3DEvlE/6ZmeIHIF5OJ+hWTG+4XSY1mr8fT2AYV3TKYRp6O82TJbSnwE4XI6CW
7pgxxfC7EYhm/u0txX8YUs/+FVmZTCch4bRdIDKoL3g4nKWgtNaKdln9AYvP6xAh
lWcnspcetWL4s2QE5cvRsTzHHNxRfzDGn+HcEC3moDZs6WWC9iDmrCBBTGqOZX2W
kxQk+PN/d8ZEBPttVe0tWln//FmDBMRsDFtEd5JMG+m++VoAMsNQfgWXg7Jrb/u8
v/GSpFBhgeo=
=eXjX
-----END PGP SIGNATURE-----