CVE-2016-6317

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.

CVSS v3 7.5 HIGH
CVSS v2.0 5.0 MEDIUM

7.5^/10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2016-1855.html
http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/	Release Notes
http://www.openwall.com/lists/oss-security/2016/08/11/4	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/92434
https://groups.google.com/forum/#%21topic/ruby-security-ann/WccgKSKiPZA
http://rhn.redhat.com/errata/RHSA-2016-1855.html
http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/	Release Notes
http://www.openwall.com/lists/oss-security/2016/08/11/4	Mailing List Third Party Advisory
http://www.securityfocus.com/bid/92434
https://groups.google.com/forum/#%21topic/ruby-security-ann/WccgKSKiPZA

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:rubyonrails:rails:4.2.0:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.0:beta1::::::
	cpe:2.3:a:rubyonrails:rails:4.2.0:beta2::::::
	cpe:2.3:a:rubyonrails:rails:4.2.0:beta3::::::
	cpe:2.3:a:rubyonrails:rails:4.2.0:beta4::::::
	cpe:2.3:a:rubyonrails:rails:4.2.0:rc1::::::
	cpe:2.3:a:rubyonrails:rails:4.2.0:rc2::::::
	cpe:2.3:a:rubyonrails:rails:4.2.0:rc3::::::
	cpe:2.3:a:rubyonrails:rails:4.2.1:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.1:rc1::::::
	cpe:2.3:a:rubyonrails:rails:4.2.1:rc2::::::
	cpe:2.3:a:rubyonrails:rails:4.2.1:rc3::::::
	cpe:2.3:a:rubyonrails:rails:4.2.1:rc4::::::
	cpe:2.3:a:rubyonrails:rails:4.2.2:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.3:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.3:rc1::::::
	cpe:2.3:a:rubyonrails:rails:4.2.4:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.4:rc1::::::
	cpe:2.3:a:rubyonrails:rails:4.2.5:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.5:rc1::::::
	cpe:2.3:a:rubyonrails:rails:4.2.5:rc2::::::
	cpe:2.3:a:rubyonrails:rails:4.2.5.1:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.5.2:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.6:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.6:rc1::::::
	cpe:2.3:a:rubyonrails:rails:4.2.7:::::::*
	cpe:2.3:a:rubyonrails:rails:4.2.7:rc1::::::

History

21 Nov 2024, 02:55

Type	Values Removed	Values Added
References	~~() http://rhn.redhat.com/errata/RHSA-2016-1855.html -~~	() http://rhn.redhat.com/errata/RHSA-2016-1855.html -
References	~~() http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/ - Release Notes~~	() http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/ - Release Notes
References	~~() http://www.openwall.com/lists/oss-security/2016/08/11/4 - Mailing List, Third Party Advisory~~	() http://www.openwall.com/lists/oss-security/2016/08/11/4 - Mailing List, Third Party Advisory
References	~~() http://www.securityfocus.com/bid/92434 -~~	() http://www.securityfocus.com/bid/92434 -
References	~~() https://groups.google.com/forum/#%21topic/ruby-security-ann/WccgKSKiPZA -~~	() https://groups.google.com/forum/#%21topic/ruby-security-ann/WccgKSKiPZA -

Information

Published : 2016-09-07 19:28

Updated : 2024-11-21 02:55

NVD link : CVE-2016-6317

Mitre link : CVE-2016-6317

CVE.ORG link : CVE-2016-6317

JSON object : View

Products Affected

rubyonrails

rails

CWE

CWE-284

Improper Access Control

CWE-476

NULL Pointer Dereference

{"id": "CVE-2016-6317", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2016-09-07T19:28:11.410", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html", "source": "secalert@redhat.com"}, {"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/", "tags": ["Release Notes"], "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2016/08/11/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "http://www.securityfocus.com/bid/92434", "source": "secalert@redhat.com"}, {"url": "https://groups.google.com/forum/#%21topic/ruby-security-ann/WccgKSKiPZA", "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/", "tags": ["Release Notes"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.openwall.com/lists/oss-security/2016/08/11/4", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/92434", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://groups.google.com/forum/#%21topic/ruby-security-ann/WccgKSKiPZA", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155."}, {"lang": "es", "value": "Action Record en Ruby en Rails 4.2.x en versiones anteriores a 4.2.7.1 no considera adecuadamente las diferencias en en el manejo de par\u00e1metros entre el componente Active Record y la implementaci\u00f3n de JSON, lo que permite a atacantes remotos eludir restricciones destinadas a la consulta de base de datos y realizar comprobaciones NULL o desencadenar clausulas perdidas WHERE a trav\u00e9s de un solicitud manipulada, como se demuestra por ciertos valores \"[nil]\", un problema relacionado con CVE-2012-2660, CVE-2012-2694 y CVE-2013-0155."}], "lastModified": "2024-11-21T02:55:53.430", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A68D41F-36A9-4B77-814D-996F4E48FA79"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "709A19A5-8FD1-4F9C-A38C-F06242A94D68"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8104482C-E8F5-40A7-8B27-234FEF725FD0"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2CFF8677-EA00-4F7E-BFF9-272482206DB5"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D7DF5CD-DA28-492D-B5EE-D252ECCC8D96"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85435026-9855-4BF4-A436-832628B005FD"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56C2308F-A590-47B0-9791-7865D189196F"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A266882-DABA-4A4C-88E6-60E993EE0947"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "83F1142C-3BFB-4B72-A033-81E20DB19D02"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FA738A1-227B-4665-B65E-666883FFAE96"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F00718C-A9E8-4E85-8DA6-33BF11F2DCCE"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10789A2D-6401-4119-BFBE-2EE4C16216D3"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70ABD462-7142-4831-8EB6-801EC1D05573"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "81D717DB-7C80-48AA-A774-E291D2E75D6E"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "06B357FB-0307-4EFA-9C5B-3C2CDEA48584"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4BD8840-0F1C-49D3-B843-9CFE64948018"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "79D5B492-43F9-470F-BD21-6EFD93E78453"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4EC1F602-D48C-458A-A063-4050BE3BB25F"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F6A1C015-56AD-489C-B301-68CF1DBF1BEF"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD191625-ACE2-46B6-9AAD-12D682C732C2"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02C7DB56-267B-4057-A9BA-36D1E58C6282"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC163D49-691B-4125-A983-6CF6F6D86DEE"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68B537D1-1584-4D15-9C75-08ED4D45DC3A"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A19315C-9A9D-45FE-81C8-074744825B98"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E3B4233-E117-4E77-A60D-3DFD5073154D"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "392CF25B-8400-4185-863F-D6353B664FB2"}, {"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.7:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3037282A-863A-4C92-A40C-4D436D2621C1"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}

7.5 /10

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

5.0 /10

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

JSON object

Attach tags to CVE-2016-6317

7.5^/10

5.0^/10

Attach tags to `CVE-2016-6317`