Skip to content

Commit 094b8b6

Browse files
author
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@6b88736 
1 parent 3616b1d commit 094b8b6

File tree

5 files changed

+403
-167
lines changed

5 files changed

+403
-167
lines changed

‎advisories/_posts/2016-01-25-CVE-2015-7576.md

Lines changed: 102 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -13,46 +13,109 @@ advisory:
1313
date: 2016-01-25
1414
url: https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k
1515
title: Timing attack vulnerability in basic authentication in Action Controller.
16-
description: "There is a timing attack vulnerability in the basic authentication
17-
support \nin Action Controller. This vulnerability has been assigned the CVE \nidentifier
18-
CVE-2015-7576. \n\nVersions Affected: All. \nNot affected: None. \nFixed
19-
Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1 \n\nImpact \n------ \nDue
20-
to the way that Action Controller compares user names and passwords in \nbasic
21-
authentication authorization code, it is possible for an attacker to \nanalyze
22-
the time taken by a response and intuit the password. \n\nFor example, this string
23-
comparison: \n\n \"foo\" == \"bar\" \n\nis possibly faster than this comparison:
24-
\n\n \"foo\" == \"fo1\" \n\nAttackers can use this information to attempt to
25-
guess the username and \npassword used in the basic authentication system. \n\nYou
26-
can tell you application is vulnerable to this attack by looking for \n`http_basic_authenticate_with`
27-
method calls in your application. \n\nAll users running an affected release should
28-
either upgrade or use one of \nthe workarounds immediately. \n\nReleases \n--------
29-
\nThe FIXED releases are available at the normal locations. \n\nWorkarounds \n-----------
30-
\nIf you can't upgrade, please use the following monkey patch in an initializer
31-
\nthat is loaded before your application: \n\n``` \n$ cat config/initializers/basic_auth_fix.rb
32-
\nmodule ActiveSupport \n module SecurityUtils \n def secure_compare(a, b)
33-
\n return false unless a.bytesize == b.bytesize \n\n l = a.unpack \"C#{a.bytesize}\"
34-
\n\n res = 0 \n b.each_byte { |byte| res |= byte ^ l.shift } \n res
35-
== 0 \n end \n module_function :secure_compare \n\n def variable_size_secure_compare(a,
36-
b) \n secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b))
37-
\n end \n module_function :variable_size_secure_compare \n end \nend \n\nmodule
38-
ActionController \n class Base \n def self.http_basic_authenticate_with(options
39-
= {}) \n before_action(options.except(:name, :password, :realm)) do \n authenticate_or_request_with_http_basic(options[:realm]
40-
|| \"Application\") do |name, password| \n # This comparison uses & so
41-
that it doesn't short circuit and \n # uses `variable_size_secure_compare`
42-
so that length information \n # isn't leaked. \n ActiveSupport::SecurityUtils.variable_size_secure_compare(name,
43-
options[:name]) & \n ActiveSupport::SecurityUtils.variable_size_secure_compare(password,
44-
options[:password]) \n end \n end \n end \n end \nend \n``` \n\n\nPatches
45-
\n------- \nTo aid users who aren't able to upgrade immediately we have provided
46-
patches for \nthe two supported release series. They are in git-am format and
47-
consist of a \nsingle changeset. \n\n* 4-1-basic_auth.patch - Patch for 4.1 series
48-
\n* 4-2-basic_auth.patch - Patch for 4.2 series \n* 5-0-basic_auth.patch - Patch
49-
for 5.0 series \n\nPlease note that only the 4.1.x and 4.2.x series are supported
50-
at present. Users \nof earlier unsupported releases are advised to upgrade as
51-
soon as possible as we \ncannot guarantee the continued availability of security
52-
fixes for unsupported \nreleases. \n\nCredits \n------- \n\nThank you to Daniel
53-
Waterworth for reporting the problem and working with us to \nfix it.\n"
16+
description: |
17+
There is a timing attack vulnerability in the basic authentication support
18+
in Action Controller. This vulnerability has been assigned the CVE
19+
identifier CVE-2015-7576.
20+
21+
Versions Affected: All.
22+
Not affected: None.
23+
Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
24+
25+
Impact
26+
------
27+
Due to the way that Action Controller compares user names and passwords in
28+
basic authentication authorization code, it is possible for an attacker to
29+
analyze the time taken by a response and intuit the password.
30+
31+
For example, this string comparison:
32+
33+
"foo" == "bar"
34+
35+
is possibly faster than this comparison:
36+
37+
"foo" == "fo1"
38+
39+
Attackers can use this information to attempt to guess the username and
40+
password used in the basic authentication system.
41+
42+
You can tell you application is vulnerable to this attack by looking for
43+
`http_basic_authenticate_with` method calls in your application.
44+
45+
All users running an affected release should either upgrade or use one of
46+
the workarounds immediately.
47+
48+
Releases
49+
--------
50+
The FIXED releases are available at the normal locations.
51+
52+
Workarounds
53+
-----------
54+
If you can't upgrade, please use the following monkey patch in an initializer
55+
that is loaded before your application:
56+
57+
```
58+
$ cat config/initializers/basic_auth_fix.rb
59+
module ActiveSupport
60+
module SecurityUtils
61+
def secure_compare(a, b)
62+
return false unless a.bytesize == b.bytesize
63+
64+
l = a.unpack "C#{a.bytesize}"
65+
66+
res = 0
67+
b.each_byte { |byte| res |= byte ^ l.shift }
68+
res == 0
69+
end
70+
module_function :secure_compare
71+
72+
def variable_size_secure_compare(a, b)
73+
secure_compare(::Digest::SHA256.hexdigest(a), ::Digest::SHA256.hexdigest(b))
74+
end
75+
module_function :variable_size_secure_compare
76+
end
77+
end
78+
79+
module ActionController
80+
class Base
81+
def self.http_basic_authenticate_with(options = {})
82+
before_action(options.except(:name, :password, :realm)) do
83+
authenticate_or_request_with_http_basic(options[:realm] || "Application") do |name, password|
84+
# This comparison uses & so that it doesn't short circuit and
85+
# uses `variable_size_secure_compare` so that length information
86+
# isn't leaked.
87+
ActiveSupport::SecurityUtils.variable_size_secure_compare(name, options[:name]) &
88+
ActiveSupport::SecurityUtils.variable_size_secure_compare(password, options[:password])
89+
end
90+
end
91+
end
92+
end
93+
end
94+
```
95+
96+
97+
Patches
98+
-------
99+
To aid users who aren't able to upgrade immediately we have provided patches for
100+
the two supported release series. They are in git-am format and consist of a
101+
single changeset.
102+
103+
* 4-1-basic_auth.patch - Patch for 4.1 series
104+
* 4-2-basic_auth.patch - Patch for 4.2 series
105+
* 5-0-basic_auth.patch - Patch for 5.0 series
106+
107+
Please note that only the 4.1.x and 4.2.x series are supported at present. Users
108+
of earlier unsupported releases are advised to upgrade as soon as possible as we
109+
cannot guarantee the continued availability of security fixes for unsupported
110+
releases.
111+
112+
Credits
113+
-------
114+
115+
Thank you to Daniel Waterworth for reporting the problem and working with us to
116+
fix it.
54117
patched_versions:
55-
- "~> 5.0.0.beta1.1"
118+
- ">= 5.0.0.beta1.1"
56119
- "~> 4.2.5, >= 4.2.5.1"
57120
- "~> 4.1.14, >= 4.1.14.1"
58121
- "~> 3.2.22.1"

‎advisories/_posts/2016-01-25-CVE-2015-7577.md

Lines changed: 89 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -13,52 +13,99 @@ advisory:
1313
date: 2016-01-25
1414
url: https://groups.google.com/forum/#!topic/rubyonrails-security/cawsWcQ6c8g
1515
title: Nested attributes rejection proc bypass in Active Record
16-
description: "There is a vulnerability in how the nested attributes feature in Active
17-
Record \nhandles updates in combination with destroy flags when destroying records
18-
is \ndisabled. This vulnerability has been assigned the CVE identifier CVE-2015-7577.
19-
\n\nVersions Affected: 3.1.0 and newer \nNot affected: 3.0.x and older
20-
\nFixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1 \n\nImpact \n------
21-
\nWhen using the nested attributes feature in Active Record you can prevent the
22-
\ndestruction of associated records by passing the `allow_destroy: false` option
23-
\nto the `accepts_nested_attributes_for` method. However due to a change in the
24-
\ncommit [a9b4b5d][1] the `_destroy` flag prevents the `:reject_if` proc from
25-
\nbeing called because it assumes that the record will be destroyed anyway. \n\nHowever
26-
this isn't true if `:allow_destroy` is false so this leads to changes \nthat would
27-
have been rejected being applied to the record. Attackers could use \nthis do
28-
things like set attributes to invalid values and to clear all of the \nattributes
29-
amongst other things. The severity will be dependent on how the \napplication
30-
has used this feature. \n\nAll users running an affected release should either
31-
upgrade or use one of \nthe workarounds immediately. \n\nReleases \n-------- \nThe
32-
FIXED releases are available at the normal locations. \n\nWorkarounds \n-----------
33-
\nIf you can't upgrade, please use the following monkey patch in an initializer
34-
\nthat is loaded before your application: \n\n``` \n$ cat config/initializers/nested_attributes_bypass_fix.rb
35-
\nmodule ActiveRecord \n module NestedAttributes \n private \n\n def reject_new_record?(association_name,
36-
attributes) \n will_be_destroyed?(association_name, attributes) || call_reject_if(association_name,
37-
attributes) \n end \n\n def call_reject_if(association_name, attributes)
38-
\n return false if will_be_destroyed?(association_name, attributes) \n\n
39-
\ case callback = self.nested_attributes_options[association_name][:reject_if]
40-
\n when Symbol \n method(callback).arity == 0 ? send(callback) : send(callback,
41-
attributes) \n when Proc \n callback.call(attributes) \n end
42-
\n end \n\n def will_be_destroyed?(association_name, attributes) \n allow_destroy?(association_name)
43-
&& has_destroy_flag?(attributes) \n end \n\n def allow_destroy?(association_name)
44-
\n self.nested_attributes_options[association_name][:allow_destroy] \n end
45-
\n end \nend \n``` \n\nPatches \n------- \nTo aid users who aren't able to upgrade
46-
immediately we have provided patches for \nthe two supported release series. They
47-
are in git-am format and consist of a \nsingle changeset. \n\n* 3-2-nested-attributes-reject-if-bypass.patch
48-
- Patch for 3.2 series \n* 4-1-nested-attributes-reject-if-bypass.patch - Patch
49-
for 4.1 series \n* 4-2-nested-attributes-reject-if-bypass.patch - Patch for 4.2
50-
series \n* 5-0-nested-attributes-reject-if-bypass.patch - Patch for 5.0 series
51-
\n\nPlease note that only the 4.1.x and 4.2.x series are supported at present.
52-
Users \nof earlier unsupported releases are advised to upgrade as soon as possible
53-
as we \ncannot guarantee the continued availability of security fixes for unsupported
54-
\nreleases. \n\nCredits \n------- \nThank you to Justin Coyne for reporting the
55-
problem and working with us to fix it. \n\n[1]: https://github.com/rails/rails/commit/a9b4b5da7c216e4464eeb9dbd0a39ea258d64325
56-
\n"
16+
description: |
17+
There is a vulnerability in how the nested attributes feature in Active Record
18+
handles updates in combination with destroy flags when destroying records is
19+
disabled. This vulnerability has been assigned the CVE identifier CVE-2015-7577.
20+
21+
Versions Affected: 3.1.0 and newer
22+
Not affected: 3.0.x and older
23+
Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
24+
25+
Impact
26+
------
27+
When using the nested attributes feature in Active Record you can prevent the
28+
destruction of associated records by passing the `allow_destroy: false` option
29+
to the `accepts_nested_attributes_for` method. However due to a change in the
30+
commit [a9b4b5d][1] the `_destroy` flag prevents the `:reject_if` proc from
31+
being called because it assumes that the record will be destroyed anyway.
32+
33+
However this isn't true if `:allow_destroy` is false so this leads to changes
34+
that would have been rejected being applied to the record. Attackers could use
35+
this do things like set attributes to invalid values and to clear all of the
36+
attributes amongst other things. The severity will be dependent on how the
37+
application has used this feature.
38+
39+
All users running an affected release should either upgrade or use one of
40+
the workarounds immediately.
41+
42+
Releases
43+
--------
44+
The FIXED releases are available at the normal locations.
45+
46+
Workarounds
47+
-----------
48+
If you can't upgrade, please use the following monkey patch in an initializer
49+
that is loaded before your application:
50+
51+
```
52+
$ cat config/initializers/nested_attributes_bypass_fix.rb
53+
module ActiveRecord
54+
module NestedAttributes
55+
private
56+
57+
def reject_new_record?(association_name, attributes)
58+
will_be_destroyed?(association_name, attributes) || call_reject_if(association_name, attributes)
59+
end
60+
61+
def call_reject_if(association_name, attributes)
62+
return false if will_be_destroyed?(association_name, attributes)
63+
64+
case callback = self.nested_attributes_options[association_name][:reject_if]
65+
when Symbol
66+
method(callback).arity == 0 ? send(callback) : send(callback, attributes)
67+
when Proc
68+
callback.call(attributes)
69+
end
70+
end
71+
72+
def will_be_destroyed?(association_name, attributes)
73+
allow_destroy?(association_name) && has_destroy_flag?(attributes)
74+
end
75+
76+
def allow_destroy?(association_name)
77+
self.nested_attributes_options[association_name][:allow_destroy]
78+
end
79+
end
80+
end
81+
```
82+
83+
Patches
84+
-------
85+
To aid users who aren't able to upgrade immediately we have provided patches for
86+
the two supported release series. They are in git-am format and consist of a
87+
single changeset.
88+
89+
* 3-2-nested-attributes-reject-if-bypass.patch - Patch for 3.2 series
90+
* 4-1-nested-attributes-reject-if-bypass.patch - Patch for 4.1 series
91+
* 4-2-nested-attributes-reject-if-bypass.patch - Patch for 4.2 series
92+
* 5-0-nested-attributes-reject-if-bypass.patch - Patch for 5.0 series
93+
94+
Please note that only the 4.1.x and 4.2.x series are supported at present. Users
95+
of earlier unsupported releases are advised to upgrade as soon as possible as we
96+
cannot guarantee the continued availability of security fixes for unsupported
97+
releases.
98+
99+
Credits
100+
-------
101+
Thank you to Justin Coyne for reporting the problem and working with us to fix it.
102+
103+
[1]: https://github.com/rails/rails/commit/a9b4b5da7c216e4464eeb9dbd0a39ea258d64325
57104
unaffected_versions:
58105
- "~> 3.0.0"
59106
- "< 3.0.0"
60107
patched_versions:
61-
- "~> 5.0.0.beta1.1"
108+
- ">= 5.0.0.beta1.1"
62109
- "~> 4.2.5, >= 4.2.5.1"
63110
- "~> 4.1.14, >= 4.1.14.1"
64111
- "~> 3.2.22.1"

‎advisories/_posts/2016-01-25-CVE-2016-0751.md

Lines changed: 57 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -13,30 +13,64 @@ advisory:
1313
date: 2016-01-25
1414
url: https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc
1515
title: Possible Object Leak and Denial of Service attack in Action Pack
16-
description: "There is a possible object leak which can lead to a denial of service
17-
\nvulnerability in Action Pack. This vulnerability has been \nassigned the CVE
18-
identifier CVE-2016-0751. \n\nVersions Affected: All. \nNot affected: None.
19-
\nFixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1 \n\nImpact \n------
20-
\nA carefully crafted accept header can cause a global cache of mime types to
21-
\ngrow indefinitely which can lead to a possible denial of service attack in \nAction
22-
Pack. \n\nAll users running an affected release should either upgrade or use one
23-
of the \nworkarounds immediately. \n\nReleases \n-------- \nThe FIXED releases
24-
are available at the normal locations. \n\nWorkarounds \n----------- \nThis attack
25-
can be mitigated by a proxy that only allows known mime types in \nthe Accept
26-
header. \n\nPlacing the following code in an initializer will also mitigate the
27-
issue: \n\n```ruby \nrequire 'action_dispatch/http/mime_type' \n\nMime.const_set
28-
:LOOKUP, Hash.new { |h,k| \n Mime::Type.new(k) unless k.blank? \n} \n``` \n\nPatches
29-
\n------- \nTo aid users who aren't able to upgrade immediately we have provided
30-
patches for \nthe two supported release series. They are in git-am format and
31-
consist of a \nsingle changeset. \n\n* 5-0-mime_types_leak.patch - Patch for 5.0
32-
series \n* 4-2-mime_types_leak.patch - Patch for 4.2 series \n* 4-1-mime_types_leak.patch
33-
- Patch for 4.1 series \n* 3-2-mime_types_leak.patch - Patch for 3.2 series \n\nPlease
34-
note that only the 4.1.x and 4.2.x series are supported at present. Users \nof
35-
earlier unsupported releases are advised to upgrade as soon as possible as we
36-
\ncannot guarantee the continued availability of security fixes for unsupported
37-
\nreleases. \n\nCredits \n------- \nAaron Patterson <3<3\n"
16+
description: |
17+
There is a possible object leak which can lead to a denial of service
18+
vulnerability in Action Pack. This vulnerability has been
19+
assigned the CVE identifier CVE-2016-0751.
20+
21+
Versions Affected: All.
22+
Not affected: None.
23+
Fixed Versions: 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1
24+
25+
Impact
26+
------
27+
A carefully crafted accept header can cause a global cache of mime types to
28+
grow indefinitely which can lead to a possible denial of service attack in
29+
Action Pack.
30+
31+
All users running an affected release should either upgrade or use one of the
32+
workarounds immediately.
33+
34+
Releases
35+
--------
36+
The FIXED releases are available at the normal locations.
37+
38+
Workarounds
39+
-----------
40+
This attack can be mitigated by a proxy that only allows known mime types in
41+
the Accept header.
42+
43+
Placing the following code in an initializer will also mitigate the issue:
44+
45+
```ruby
46+
require 'action_dispatch/http/mime_type'
47+
48+
Mime.const_set :LOOKUP, Hash.new { |h,k|
49+
Mime::Type.new(k) unless k.blank?
50+
}
51+
```
52+
53+
Patches
54+
-------
55+
To aid users who aren't able to upgrade immediately we have provided patches for
56+
the two supported release series. They are in git-am format and consist of a
57+
single changeset.
58+
59+
* 5-0-mime_types_leak.patch - Patch for 5.0 series
60+
* 4-2-mime_types_leak.patch - Patch for 4.2 series
61+
* 4-1-mime_types_leak.patch - Patch for 4.1 series
62+
* 3-2-mime_types_leak.patch - Patch for 3.2 series
63+
64+
Please note that only the 4.1.x and 4.2.x series are supported at present. Users
65+
of earlier unsupported releases are advised to upgrade as soon as possible as we
66+
cannot guarantee the continued availability of security fixes for unsupported
67+
releases.
68+
69+
Credits
70+
-------
71+
Aaron Patterson <3<3
3872
patched_versions:
39-
- "~> 5.0.0.beta1.1"
73+
- ">= 5.0.0.beta1.1"
4074
- "~> 4.2.5, >= 4.2.5.1"
4175
- "~> 4.1.14, >= 4.1.14.1"
4276
- "~> 3.2.22.1"

0 commit comments

Comments
 (0)