Test ID:	1.3.6.1.4.1.25623.1.0.702613
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2613-1)
Summary:	The remote host is missing an update for the Debian 'rails' package(s) announced via the DSA-2613-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'rails' package(s) announced via the DSA-2613-1 advisory. Vulnerability Insight: Lawrence Pit discovered that Ruby on Rails, a web development framework, is vulnerable to a flaw in the parsing of JSON to YAML. Using a specially crafted payload attackers can trick the backend into decoding a subset of YAML. The vulnerability has been addressed by removing the YAML backend and adding the OkJson backend. For the stable distribution (squeeze), this problem has been fixed in version 2.3.5-1.2+squeeze6. For the testing distribution (wheezy), this problem will be fixed soon. For the unstable distribution (sid), this problem has been fixed in version 2.3.14-6 of the ruby-activesupport-2.3 package. The 3.2 version of rails as found in Debian wheezy and sid is not affected by the problem. We recommend that you upgrade your rails packages. Affected Software/OS: 'rails' package(s) on Debian 6. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2013-0333 APPLE-SA-2013-03-14-1 http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html APPLE-SA-2013-06-04-1 http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html DSA-2613 http://www.debian.org/security/2013/dsa-2613 RHSA-2013:0201 http://rhn.redhat.com/errata/RHSA-2013-0201.html RHSA-2013:0202 http://rhn.redhat.com/errata/RHSA-2013-0202.html RHSA-2013:0203 http://rhn.redhat.com/errata/RHSA-2013-0203.html VU#628463 http://www.kb.cert.org/vuls/id/628463 [rubyonrails-security] 20130129 Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 https://groups.google.com/group/rubyonrails-security/msg/52179af76915e518?dmode=source&output=gplain http://support.apple.com/kb/HT5784 http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/ https://puppet.com/security/cve/cve-2013-0333
Copyright	Copyright (C) 2013 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.