Ubuntu.comUB:CVE-2012-6496CVE-2012-6496
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.004 Low
EPSS
Percentile
74.7%
SQL injection vulnerability in the Active Record component in Ruby on Rails
before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote
attackers to execute arbitrary SQL commands via a crafted request that
leverages incorrect behavior of dynamic finders in applications that can
use unexpected data types in certain find_by_ method calls.
Notes
| Author | Note |
|---|---|
| mdeslaur | in Oneiric+, rails package is just for transition |
| seth-arnold | The authlogic gem was frequently cited as the problem in early reports, but the problem is with core Active Record. authlogic was just one vector known to allow exploiting the problem. CVE-2012-5664 was rejected as a result of the confusion. |
References
blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts
www.openwall.com/lists/oss-security/2013/01/03/12
www.openwall.com/lists/oss-security/2013/01/03/5
groups.google.com/forum/#!topic/rubyonrails-security/DCNTNp_qjFM
launchpad.net/bugs/cve/CVE-2012-6496
nvd.nist.gov/vuln/detail/CVE-2012-6496
security-tracker.debian.org/tracker/CVE-2012-6496
www.cve.org/CVERecord?id=CVE-2012-6496
Related
7.5 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.004 Low
EPSS
Percentile
74.7%