Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 294797 (CVE-2009-4214) - <dev-ruby/rails-2.3.5 XSS weakness in strip_tags (CVE-2009-4214)
Summary: <dev-ruby/rails-2.3.5 XSS weakness in strip_tags (CVE-2009-4214)
Status: RESOLVED FIXED
Alias: CVE-2009-4214
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High minor (vote)
Assignee: Gentoo Security
URL: http://groups.google.com/group/rubyon...
Whiteboard: B3 [glsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2009-11-27 07:56 UTC by Hans de Graaff
Modified: 2009-12-20 12:12 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
Patch for Rails 2.2.x (2-2-strip_tags.patch,2.04 KB, patch)
2009-11-27 07:56 UTC, Hans de Graaff
no flags Details | Diff
Rails 2.3.x patch (2-3-strip_tags.patch,2.05 KB, patch)
2009-11-27 07:57 UTC, Hans de Graaff
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Hans de Graaff gentoo-dev Security 2009-11-27 07:56:06 UTC
From the rubyonrails-security list:

There is a weakness in the strip_tags function in ruby on rails.  Due to
a bug in the parsing code inside HTML::Tokenizer regarding non-printable
ascii characters, an attacker can include values which certain browsers
will then evaluate.

Versions Affected:  All versions prior to 2.3.4 or 2.2.s
Not affected:       Applications which do not use strip_tags
Fixed Versions:     2.3.5

Impact
------

Applications relying on strip_tags for XSS protection may be vulnerable
to attacks on Internet Explorer users.

Releases
--------

The 2.3.5 releases is available at the normal locations now.

Workarounds
-----------

Users using strip_tags can pass the resulting output to the regular
escaping functionality:

  <%= h(strip_tag(...)) %>


Patches
-------

To aid users who aren't able to upgrade immediately we have provided
patches for the two supported release series.  They are in git-am format
and consist of a single changeset updating the parser and providing an
additional unit test.

* 2-2-strip_tags.patch - Patch for 2.2 series
* 2-3-strip_tags.patch - Patch for 2.3 series

Please note that only the  2.2.x and 2.3.x series are supported at
present.  Users of earlier unsupported releases are advised to upgrade
at their earliest convenience.

Credits
-------
Thanks to Gabe da Silveira for reporting the vulnerability to us and
providing the fix.
Comment 1 Hans de Graaff gentoo-dev Security 2009-11-27 07:56:55 UTC
Created attachment 211294 [details, diff]
Patch for Rails 2.2.x
Comment 2 Hans de Graaff gentoo-dev Security 2009-11-27 07:57:12 UTC
Created attachment 211295 [details, diff]
Rails 2.3.x patch
Comment 3 Hans de Graaff gentoo-dev Security 2009-11-27 07:58:34 UTC
As far as I can tell upstream has only released Rails 2.3.5. If we want to keep the 2.2.x series around we need to patch it ourselves, it seems like.
Comment 4 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-11-28 11:23:41 UTC
Arches, please test and mark stable:

2.2 slot:
=dev-ruby/actionpack-2.2.3-r1
=dev-ruby/rails-2.2.3-r1
Target keywords : "amd64 ia64 ppc ppc64 sparc x86"

2.3 slot:
=dev-ruby/activesupport-2.3.5
=dev-ruby/actionpack-2.3.5
=dev-ruby/activeresource-2.3.5
=dev-ruby/actionmailer-2.3.5
=dev-ruby/activerecord-2.3.5
=dev-ruby/rails-2.3.5
Target keywords : "amd64 ia64 ppc ppc64 sparc x86"
Comment 5 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-11-30 09:26:12 UTC
Please also stabilize dev-ruby/rack-1.0.1.
Comment 6 Markus Meier gentoo-dev 2009-11-30 10:45:51 UTC
amd64/x86 stable
Comment 7 Brent Baude (RETIRED) gentoo-dev 2009-11-30 18:03:22 UTC
ppc64 done
Comment 8 Raúl Porcel (RETIRED) gentoo-dev 2009-11-30 18:47:51 UTC
ia64/sparc stable
Comment 9 Stefan Behte (RETIRED) gentoo-dev Security 2009-12-12 00:58:39 UTC
CVE-2009-4214 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-4214):
  Cross-site scripting (XSS) vulnerability in the strip_tags function
  in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote
  attackers to inject arbitrary web script or HTML via vectors
  involving non-printing ASCII characters, related to HTML::Tokenizer
  and actionpack/lib/action_controller/vendor/html-scanner/html/node.rb.

Comment 10 Jeroen Roovers (RETIRED) gentoo-dev 2009-12-19 14:26:00 UTC
Stable for PPC.
Comment 11 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-12-19 14:29:06 UTC
GLSA together with #200159, #237385, #247549, #276279, and #283396.
Draft alread filed, advisory will be sent tonight. 
Comment 12 Alex Legler (RETIRED) archtester gentoo-dev Security 2009-12-20 12:12:05 UTC
GLSA 200912-02