PARTNERS CLIENTS TEAM
BLOG
CONTACT

Posted by Nathan Kaiser on Wed Jun 10 09:52:00 UTC 2009

Yesterday, both the Rails core team and the Ruby team announce a vulnerability in the Big Decimal libraries of Ruby. This vulnerability does not allow for remote access to your data, however it can allow an attacker to create a Denial of Service attack on your application, essentially rendering it down. To quote the Ruby Team…

A denial of service (DoS) vulnerability was found on the BigDecimal standard library of Ruby. Conversion from BigDecimal objects into Float numbers had a problem which enables attackers to effectively cause segmentation faults.

ActiveRecord relies on this method, so most Rails applications are affected by this. Though this is not a Rails-specific issue.

We’ve promptly patched our Ruby RPMs and posted information on how to update in our System Status blog. For users on Debian or Ubuntu, updates should be hitting their repos over the next few days. If you can’t upgrade, we recommend you implement the work arounds provided by the Rails core team. Information on those can be found here:

http://weblog.rubyonrails.org/2009/6/10/dos-vulnerability-in-ruby

Our patching instructions for our RPM versions are available here:

http://www.blueboxgrp.com/system_status/2009/06/ruby_security_bug

We strongly recommend for all of our customers to follow those instructions as soon as possible. For assistance, please don’t hesitate to contact us.

Thanks!

  • Jesse Proudman

Blue Box Group

The Latest

Archives

The Feed