Summary
An interpretation conflict can cause the Active Record component of Rails, a web framework for the Ruby programming language, to truncate queries in unexpected ways. This may allow attackers to elevate their privileges.
Solution
For the stable distribution (squeeze), this problem has been fixed in version 2.3.5-1.2+squeeze5.
We recommend that you upgrade your rails packages.
Insight
Rails is a full-stack, open-source web framework in Ruby for writing real-world applications.
Affected
rails on Debian Linux
Detection
This check tests the installed software version using the apt package manager.
References
Updated on 2015-03-25
Severity
Classification
-
CVE CVE-2013-0155 -
CVSS Base Score: 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:N
Related Vulnerabilities