Test ID:	1.3.6.1.4.1.25623.1.0.64919
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-1887-1)
Summary:	The remote host is missing an update for the Debian 'rails' package(s) announced via the DSA-1887-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'rails' package(s) announced via the DSA-1887-1 advisory. Vulnerability Insight: Brian Mastenbrook discovered that rails, the MVC ruby based framework geared for web application development, is prone to cross-site scripting attacks via malformed strings in the form helper. For the oldstable distribution (etch) security support has been discontinued. It has been reported that rails in oldstable is unusable and several features that are affected by security issues are broken due to programming issues. It is highly recommended to upgrade to the version in stable (lenny). For the stable distribution (lenny), this problem has been fixed in version 2.1.0-7. For the testing distribution (squeeze) and the unstable distribution (sid), this problem has been fixed in version 2.2.3-1. We recommend that you upgrade your rails packages. Affected Software/OS: 'rails' package(s) on Debian 5. Solution: Please install the updated package(s). CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-3009 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html BugTraq ID: 36278 http://www.securityfocus.com/bid/36278 Debian Security Information: DSA-1887 (Google Search) http://www.debian.org/security/2009/dsa-1887 http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4?dmode=source http://www.osvdb.org/57666 http://securitytracker.com/id?1022824 http://secunia.com/advisories/36600 http://secunia.com/advisories/36717 SuSE Security Announcement: SUSE-SR:2009:017 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html http://www.vupen.com/english/advisories/2009/2544 XForce ISS Database: rubyonrails-unicode-xss(53036) https://exchange.xforce.ibmcloud.com/vulnerabilities/53036
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.