CVE-2013-0269
개요
CVE.org에서
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
내용
Red Hat Satellite tools ship RubyGem Json 1.4.6 which is earlier than affected 1.5.5 version however, this version of RubyGem is not affected to the flaw. We may update RubyGem in a future release.
CVSS (Common Vulnerability Scoring System) 점수 세부 사항
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v2 점수 분석
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| 기본 점수 | 7.5 | 7.5 | N/A |
| 공격 벡터 | Network | Network | N/A |
| 액세스 복잡성 | Low | Low | N/A |
| 인증 | None | None | N/A |
| 기밀성에 미치는 영향 | Partial | Partial | N/A |
| 무결성에 미치는 영향 | Partial | Partial | N/A |
| 가용성에 미치는 영향 | Partial | Partial | N/A |
벡터
Red Hat: AV:N/AC:L/Au:N/C:P/I:P/A:P
NVD: AV:N/AC:L/Au:N/C:P/I:P/A:P
취약점 이해 (CWE)
Integrity
Technical Impact: Modify Application Data; Unexpected State
Attackers can modify unexpected objects or data that was assumed to be safe from modification. Deserialized data or code could be modified without using the provided accessor functions, or unexpected functions could be invoked.
Availability
Technical Impact: DoS: Resource Consumption (CPU)
If a function is making an assumption on when to terminate, based on a sentry in a string, it could easily never terminate.
Other
Technical Impact: Varies by Context
The consequences can vary widely, because it depends on which objects or methods are being deserialized, and how they are used. Making an assumption that the code in the deserialized object is valid is dangerous and can enable exploitation. One example is attackers using gadget chains to perform unauthorized actions, such as generating a shell.
감사의 말
Red Hat would like to thank Ruby on Rails upstream for reporting this issue. Upstream acknowledges Ben Murphy and Thomas Hollstegge (Zweitag) as the original reporters.
