SUSE-SU-2012:0434-1: moderate: Security update for Ruby On Rails

Fri Mar 30 11:08:17 MDT 2012

   SUSE Security Update: Security update for Ruby On Rails
______________________________________________________________________________

Announcement ID:    SUSE-SU-2012:0434-1
Rating:             moderate
References:         #668817 #712057 #712058 #712060 #712062 
Cross-References:   CVE-2010-3933 CVE-2011-0446 CVE-2011-0447
                    CVE-2011-0448 CVE-2011-0449 CVE-2011-2930
                    CVE-2011-2931 CVE-2011-2932 CVE-2011-3186

Affected Products:
                    WebYaST [Appliance - Tools]
                    WebYaST 1.2
                    SUSE Studio Standard Edition 1.2
                    SUSE Studio Onsite 1.2
                    SUSE Studio Extension for System z 1.2
                    SUSE Linux Enterprise Software Development Kit 11 SP1
______________________________________________________________________________

   An update that fixes 9 vulnerabilities is now available. It
   includes two new package versions.

Description:

   This update of Ruby on Rails to 2.3.14 fixes the following
   security issues:

   * CVE-2011-2930 - SQL-injection in quote_table_name
   function via specially crafted column names (bnc#712062)
   * CVE-2011-2931 - Cross-Site Scripting (XSS) in the
   strip_tags helper (bnc#712057)
   * CVE-2011-3186 - Response Splitting (bnc#712058)
   * CVE-2010-3933 - Arbitrary modification of records via
   specially crafted form parameters (bnc#712058)
   * CVE-2011-0446 - Cross-Site Scripting (XSS) in the
   mail_to helper (bnc#668817)
   * CVE-2011-0447 - Improper validation of
   'X-Requested-With' header (bnc#668817)
   * CVE-2011-0448 - SQL-injection caused by improperly
   sanitized arguments to the limit function (bnc#668817)
   * CVE-2011-0449 - Bypass of access restrictions via
   specially crafted action names (bnc#668817)
   * CVE-2011-2932 - Cross-Site Scripting in
   output_safety.rb (bnc#712060)

   Security Issue reference:

   * CVE-2011-2930
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2930
   >
   * CVE-2011-2931
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2931
   >
   * CVE-2011-3186
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3186
   >
   * CVE-2010-3933
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3933
   >
   * CVE-2011-0446
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0446
   >
   * CVE-2011-0447
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0447
   >
   * CVE-2011-0448
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0448
   >
   * CVE-2011-0449
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0449
   >
   * CVE-2011-2932
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2932
   >

Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - WebYaST [Appliance - Tools]:

      zypper in -t patch slewystsp1-rubyonrails-2314-201202-5884

   - WebYaST 1.2:

      zypper in -t patch slewyst12-rubyonrails-2314-201202-5884

   - SUSE Studio Standard Edition 1.2:

      zypper in -t patch sleslms12-rubyonrails-2314-201202-5884

   - SUSE Studio Onsite 1.2:

      zypper in -t patch slestso12-rubyonrails-2314-201202-5884

   - SUSE Studio Extension for System z 1.2:

      zypper in -t patch slestso12-rubyonrails-2314-201202-5884

   - SUSE Linux Enterprise Software Development Kit 11 SP1:

      zypper in -t patch sdksp1-rubyonrails-2314-201202-5884

   To bring your system up-to-date, use "zypper patch".

Package List:

   - WebYaST [Appliance - Tools] (i586 ia64 ppc64 s390x x86_64) [New Version: 1.1.2 and 2.3.14]:

      rubygem-actionmailer-2_3-2.3.14-0.7.4.3
      rubygem-actionpack-2_3-2.3.14-0.7.4.3
      rubygem-activerecord-2_3-2.3.14-0.7.4.3
      rubygem-activeresource-2_3-2.3.14-0.7.4.3
      rubygem-activesupport-2_3-2.3.14-0.7.4.3
      rubygem-rack-1.1.2-0.8.8.3
      rubygem-rails-2_3-2.3.14-0.7.4.3

   - WebYaST 1.2 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.1.2 and 2.3.14]:

      rubygem-actionmailer-2_3-2.3.14-0.7.4.3
      rubygem-actionpack-2_3-2.3.14-0.7.4.3
      rubygem-activerecord-2_3-2.3.14-0.7.4.3
      rubygem-activeresource-2_3-2.3.14-0.7.4.3
      rubygem-activesupport-2_3-2.3.14-0.7.4.3
      rubygem-rack-1.1.2-0.8.8.3
      rubygem-rails-2_3-2.3.14-0.7.4.3

   - SUSE Studio Standard Edition 1.2 (x86_64) [New Version: 1.1.2 and 2.3.14]:

      rubygem-actionmailer-2_3-2.3.14-0.7.4.3
      rubygem-actionpack-2_3-2.3.14-0.7.4.3
      rubygem-activerecord-2_3-2.3.14-0.7.4.3
      rubygem-activeresource-2_3-2.3.14-0.7.4.3
      rubygem-activesupport-2_3-2.3.14-0.7.4.3
      rubygem-rack-1.1.2-0.8.8.3
      rubygem-rails-2_3-2.3.14-0.7.4.3

   - SUSE Studio Standard Edition 1.2 (noarch) [New Version: 2.3.14]:

      rubygem-rails-2.3.14-0.8.6.1

   - SUSE Studio Onsite 1.2 (x86_64) [New Version: 1.1.2 and 2.3.14]:

      rubygem-actionmailer-2_3-2.3.14-0.7.4.3
      rubygem-actionpack-2_3-2.3.14-0.7.4.3
      rubygem-activerecord-2_3-2.3.14-0.7.4.3
      rubygem-activeresource-2_3-2.3.14-0.7.4.3
      rubygem-activesupport-2_3-2.3.14-0.7.4.3
      rubygem-rack-1.1.2-0.8.8.3
      rubygem-rails-2_3-2.3.14-0.7.4.3

   - SUSE Studio Extension for System z 1.2 (s390x) [New Version: 1.1.2 and 2.3.14]:

      rubygem-actionmailer-2_3-2.3.14-0.7.4.3
      rubygem-actionpack-2_3-2.3.14-0.7.4.3
      rubygem-activerecord-2_3-2.3.14-0.7.4.3
      rubygem-activeresource-2_3-2.3.14-0.7.4.3
      rubygem-activesupport-2_3-2.3.14-0.7.4.3
      rubygem-rack-1.1.2-0.8.8.3
      rubygem-rails-2_3-2.3.14-0.7.4.3

   - SUSE Linux Enterprise Software Development Kit 11 SP1 (i586 ia64 ppc64 s390x x86_64) [New Version: 1.1.2 and 2.3.14]:

      rubygem-actionmailer-2_3-2.3.14-0.7.4.3
      rubygem-actionpack-2_3-2.3.14-0.7.4.3
      rubygem-activerecord-2_3-2.3.14-0.7.4.3
      rubygem-activeresource-2_3-2.3.14-0.7.4.3
      rubygem-activesupport-2_3-2.3.14-0.7.4.3
      rubygem-rack-1.1.2-0.8.8.3
      rubygem-rails-2_3-2.3.14-0.7.4.3

   - SUSE Linux Enterprise Software Development Kit 11 SP1 (noarch) [New Version: 2.3.14]:

      rubygem-rails-2.3.14-0.8.6.1

References:

   http://support.novell.com/security/cve/CVE-2010-3933.html
   http://support.novell.com/security/cve/CVE-2011-0446.html
   http://support.novell.com/security/cve/CVE-2011-0447.html
   http://support.novell.com/security/cve/CVE-2011-0448.html
   http://support.novell.com/security/cve/CVE-2011-0449.html
   http://support.novell.com/security/cve/CVE-2011-2930.html
   http://support.novell.com/security/cve/CVE-2011-2931.html
   http://support.novell.com/security/cve/CVE-2011-2932.html
   http://support.novell.com/security/cve/CVE-2011-3186.html
   https://bugzilla.novell.com/668817
   https://bugzilla.novell.com/712057
   https://bugzilla.novell.com/712058
   https://bugzilla.novell.com/712060
   https://bugzilla.novell.com/712062
   http://download.novell.com/patch/finder/?keywords=a9a7e5b0e289aeb951fcc43761e059bf