CVE-2011-0449
First published: Mon Feb 21 2011(Updated: )
actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ruby on Rails | =3.0.0-beta | |
| Ruby on Rails | =3.0.0-beta2 | |
| Ruby on Rails | =3.0.0-beta3 | |
| Ruby on Rails | =3.0.0-beta4 | |
| Ruby on Rails | =3.0.0-rc | |
| Ruby on Rails | =3.0.0-rc2 | |
| Ruby on Rails | =3.0.1-pre | |
| Ruby on Rails | =3.0.2-pre | |
| Ruby on Rails | =3.0.0 | |
| Ruby on Rails | =3.0.1 | |
| Ruby on Rails | =3.0.2 | |
| Ruby on Rails | =3.0.3 | |
| Ruby on Rails | =3.0.4-rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://groups.google.com/group/rubyonrails-security/msg/04345b2e84df5b4f?dmode=source&output=gplain
- http://securitytracker.com/id?1025061
- http://secunia.com/advisories/43278
- http://weblog.rubyonrails.org/2011/2/8/new-releases-2-3-11-and-3-0-4
- http://www.vupen.com/english/advisories/2011/0877
- http://lists.fedoraproject.org/pipermail/package-announce/2011-April/057650.html
Frequently Asked Questions
What is the severity of CVE-2011-0449?
CVE-2011-0449 has been classified with a significant severity rating due to its potential to allow unauthorized access.
How do I fix CVE-2011-0449?
To fix CVE-2011-0449, update Ruby on Rails to version 3.0.4 or later.
Which versions of Ruby on Rails are affected by CVE-2011-0449?
CVE-2011-0449 affects Ruby on Rails 3.0.x versions prior to 3.0.4.
What type of attacks could exploit CVE-2011-0449?
CVE-2011-0449 could be exploited by attackers to bypass access restrictions on templates.
Is CVE-2011-0449 related to case sensitivity in filesystems?
Yes, CVE-2011-0449 exploits issues that arise when using case-insensitive filesystems.
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/weakness
- agent/last-modified-date
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/rubyonrails
- canonical/ruby on rails
- version/ruby on rails/3.0.0-beta
- version/ruby on rails/3.0.0-beta2
- version/ruby on rails/3.0.0-beta3
- version/ruby on rails/3.0.0-beta4
- version/ruby on rails/3.0.0-rc
- version/ruby on rails/3.0.0-rc2
- version/ruby on rails/3.0.1-pre
- version/ruby on rails/3.0.2-pre
- version/ruby on rails/3.0.0
- version/ruby on rails/3.0.1
- version/ruby on rails/3.0.2
- version/ruby on rails/3.0.3
- version/ruby on rails/3.0.4-rc1