Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2016.0241
rails security update
1 February 2016
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: rails
Publisher: Debian
Operating System: Debian GNU/Linux 7
Debian GNU/Linux 8
UNIX variants (UNIX, Linux, OSX)
Windows
Impact/Access: Access Privileged Data -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Cross-site Scripting -- Remote with User Interaction
Reduced Security -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2016-0753 CVE-2016-0752 CVE-2016-0751
CVE-2015-7581 CVE-2015-7577 CVE-2015-7576
CVE-2015-3227 CVE-2015-3226
Original Bulletin:
http://www.debian.org/security/2016/dsa-3464
Comment: This advisory references vulnerabilities in products which run on
platforms other than Debian. It is recommended that administrators
running rails check for an updated version of the software for their
operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-3464-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
January 31, 2016 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : rails
CVE ID : CVE-2015-3226 CVE-2015-3227 CVE-2015-7576 CVE-2015-7577
CVE-2015-7581 CVE-2016-0751 CVE-2016-0752 CVE-2016-0753
Multiple security issues have been discovered in the Rails on Rails web
application development framework, which may result in denial of service,
cross-site scripting, information disclosure or bypass of input
validation.
For the stable distribution (jessie), these problems have been fixed in
version 2:4.1.8-1+deb8u1.
For the unstable distribution (sid), these problems have been fixed in
version 2:4.2.5.1-1.
We recommend that you upgrade your rails packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v2
iQIcBAEBCAAGBQJWrlW7AAoJEBDCk7bDfE429bsQAJbxqXoQMEjnr8jd1I6zfWlF
0rn734+1IKDIPmtRa7bXVqm/WGIRc6hzLq2xfeWsFD7eH2yxNAEEFELGye8SaAMW
Z6rdXudmXDsRv/H7uKcWPftqL2rJZO4/CJRbOW5cTmSKMgMBcTYxE9zAxaHzEH9D
JJ3zjipJbncsCscyEcAFXt0nktMzKpQPnAgQ9nwSo6k9U2LLPBx8LNpokjIPH6SU
0p9uxc9q3ct0O9kEWCU6JDUGgSjaSbLE21buT5QRqkqUtdp5ZW0u6qTH8fT2es7H
e4EYZTJLLxw65qSmvFjoxFPRZbP2mv5wz+6zEq3Dn2zILlbyQZ/07Cgt8O935535
LMwGx9lXLHoH8RlyWQ9xkip2s5ltPJltRRWvVjA5CL1m/NQefnpi82VmTXgwnCxh
uce0rktFdxKuKIvIm5bX98Eyh/2RfQ0apd6UxpJG/8OmLdHGWeCGG5CBvLw+FEVB
+S17dr1+Gsg0U2ac1jcd5kDbn9eUR+8D6CIzPdpQHSrEaNezsb3KyOn1k8Dde9a/
SyMQhpBt1Ua9Fl2tJAJHIu4t1nsBlhKw6XYND6ER4vKjYK5l12VUbEvn1ZLqapSn
/0CcT2An7UKqZR23LefxckVF1iAPnjuliTO2VL5rGdYxE7xm9GZh5ME8jxqw8EWC
+s3gAMfwSdOGdT8+0g1s
=Pmrh
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBVq68C36ZAP0PgtI9AQIRiBAArQaVVQxDjX7dD1+7PpFtJQz82m3KAQYq
RbqY6ks9pR5qKNgGX3eoNKgaDdnX122x73vqFJ7LWImgrSkAd6b13C4Na/h8dy+y
kwhLt5Q/0y2a5Vf4sAdK4e3tKYX1PHkvqEyJ2m32uV/NeAmdP4eJk/IZJm8UKvyy
HqW7pSLJXR41tafSppu7o+0jqGxPgzI9snekyFa1E1GyxVZGB1GDR5Gdf93j/cA+
nxLlt2fp1ReV70pSolnTwfabptaGjHLVghCcePuB3SjgMgBbijXQh+xGtiVJlCcb
4ZOBNaMYmyPRjUCeb6uvdcwb8GWbTqQ/yLyh74BecweL6tZU9pFYyQjJRjgB5PQf
sESOsDc5u0YHqKnJuUMCbuahAcHFG5lTlYvFELqLkpZsYaso4b4r7O8Lioj2yBUn
SPLjIQS8g5u2I262qcnSD7fOG5PXvqqHby7ne4nI8uJ5Dehb0lZJR1k/YGSz6nln
HhQVtlgwfLHy2fkFUdZ7mSEdtBV07RH4O1XbTEpaUlN9BhOwZJ2C6V3XBDEQysNA
BqEA07lNA5PCw6HyZyBRYeEK5f7mHX3gTrNOsv1CgoDoXEP7sE4nQZTyMJ83jZ58
B8iHF2LEe2bSCNYnIKfvzPn8gQ8mODIIFkg48dgV4fZk7HOHe5+/HxwJ+npWTg2W
x7h+pqhQi6A=
=CmUS
-----END PGP SIGNATURE-----