PT-2016-1514 · Ruby+1 · Ruby On Rails+1
Daniel Waterworth
·
Publicado
2016-01-31
·
Atualizado
2019-08-08
·
CVE-2015-7576
CVSS v2.0
4.3
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Ruby on Rails versions prior to 3.2.22.1
Ruby on Rails versions 4.0.x through 4.1.14
Ruby on Rails versions 4.2.x through 4.2.5
Ruby on Rails versions 5.x through 5.0.0.beta1
Description
The issue is related to the http basic authenticate with method in the Basic Authentication implementation in Action Controller, which does not use a constant-time algorithm for verifying credentials. This makes it easier for remote attackers to bypass authentication by measuring timing differences. The vulnerability can be exploited by a remote attacker to bypass the authentication procedure.
Recommendations
For Ruby on Rails versions prior to 3.2.22.1, update to version 3.2.22.1 or later.
For Ruby on Rails versions 4.0.x through 4.1.14, update to version 4.1.14.1 or later.
For Ruby on Rails versions 4.2.x through 4.2.5, update to version 4.2.5.1 or later.
For Ruby on Rails versions 5.x through 5.0.0.beta1, update to version 5.0.0.beta1.1 or later.
Exploit
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ruby On Rails
Suse