Bug 386377

Summary:	=dev-ruby/rails-{2.3.9,3.0.0}: record modification vulnerability (CVE-2010-3933)
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	ruby
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	B3 [glsa]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2011-10-08 16:06:07 UTC

CVE-2010-3933 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3933):
  Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes,
  which allows remote attackers to modify arbitrary records by changing the
  names of parameters for form inputs.

Comment 1 Tobias Heinlein (RETIRED) gentoo-dev

2011-10-09 11:58:08 UTC

2x YES, added to request.

Comment 2 GLSAMaker/CVETool Bot gentoo-dev

2014-12-14 20:35:50 UTC

This issue was resolved and addressed in
 GLSA 201412-28 at http://security.gentoo.org/glsa/glsa-201412-28.xml
by GLSA coordinator Sean Amoss (ackle).