Test ID:	1.3.6.1.4.1.25623.1.0.70710
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-2301)
Summary:	The remote host is missing an update for the Debian 'rails' package(s) announced via the DSA-2301 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'rails' package(s) announced via the DSA-2301 advisory. Vulnerability Insight: Several vulnerabilities have been discovered in Rails, the Ruby web application framework. The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2009-4214 A cross-site scripting (XSS) vulnerability had been found in the strip_tags function. An attacker may inject non-printable characters that certain browsers will then evaluate. This vulnerability only affects the oldstable distribution (lenny). CVE-2011-2930 A SQL injection vulnerability had been found in the quote_table_name method that could allow malicious users to inject arbitrary SQL into a query. CVE-2011-2931 A cross-site scripting (XSS) vulnerability had been found in the strip_tags helper. An parsing error can be exploited by an attacker, who can confuse the parser and may inject HTML tags into the output document. CVE-2011-3186 A newline (CRLF) injection vulnerability had been found in response.rb. This vulnerability allows an attacker to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header. For the oldstable distribution (lenny), this problem has been fixed in version 2.1.0-7+lenny2. For the stable distribution (squeeze), this problem has been fixed in version 2.3.5-1.2+squeeze2. For the unstable distribution (sid), this problem has been fixed in version 2.3.14. We recommend that you upgrade your rails packages. This VT has been deprecated as a duplicate of the VT 'Debian Security Advisory DSA 2301-1 (rails)' (OID: 1.3.6.1.4.1.25623.1.0.70237). Affected Software/OS: 'rails' package(s) on Debian 5, Debian 6. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-4214 http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html BugTraq ID: 37142 http://www.securityfocus.com/bid/37142 Debian Security Information: DSA-2260 (Google Search) http://www.debian.org/security/2011/dsa-2260 Debian Security Information: DSA-2301 (Google Search) http://www.debian.org/security/2011/dsa-2301 http://www.openwall.com/lists/oss-security/2009/11/27/2 http://www.openwall.com/lists/oss-security/2009/12/08/3 http://groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0ab?pli=1 http://www.securitytracker.com/id?1023245 http://secunia.com/advisories/37446 http://secunia.com/advisories/38915 SuSE Security Announcement: SUSE-SR:2010:006 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html http://www.vupen.com/english/advisories/2009/3352 Common Vulnerability Exposure (CVE) ID: CVE-2011-2930 http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html http://www.openwall.com/lists/oss-security/2011/08/17/1 http://www.openwall.com/lists/oss-security/2011/08/19/11 http://www.openwall.com/lists/oss-security/2011/08/20/1 http://www.openwall.com/lists/oss-security/2011/08/22/13 http://www.openwall.com/lists/oss-security/2011/08/22/14 http://www.openwall.com/lists/oss-security/2011/08/22/5 http://groups.google.com/group/rubyonrails-security/msg/b1a85d36b0f9dd30?dmode=source&output=gplain Common Vulnerability Exposure (CVE) ID: CVE-2011-2931 http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065137.html http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065109.html http://groups.google.com/group/rubyonrails-security/msg/fd41ab62966e0fd1?dmode=source&output=gplain http://secunia.com/advisories/45921 Common Vulnerability Exposure (CVE) ID: CVE-2011-3186 http://groups.google.com/group/rubyonrails-security/msg/bbe342e43abaa78c?dmode=source&output=gplain
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.